Session Variables in Gorilla Sessions Not Maintained While Using Them

Issue

While using Gorilla Sessions web toolkit, session variables are not retained across requests. When the server launches and users visit localhost:8100/, they are directed to login.html because session values do not exist. Upon login, session variables are stored, and users are redirected to home.html. However, opening a new tab and inputting localhost:8100/ directs users to login.html instead of home.html as expected, despite the presence of session variables.

Explanation

Several issues arise in the provided code:

1. Session Path: The session path is defined as /loginSession. This restricts the validity of session cookies to this specific path. For the session to work across different paths (such as localhost:8100/home), you should set the session path to /.
2. Syntax Errors: The condition session.Values["email"] == nil is incorrect. Instead, type assertion should be used to check if the session value is a string: if val, ok := session.Values["email"].(string); ok { // Check if the value is a string }.
3. Error Handling: The session save operation (sessionNew.Save(req, res)) is not checked for errors. Add error handling to capture and handle any potential issues during session saving.
4. Session Handling in SessionHandler: The session should be obtained and validated before serving static files in the SessionHandler method. Additionally, the router path should not be set within this function as it is not scoped here. Instead, set the router path in main() and utilize a separate function that checks for a valid session before handling static file requests.

Relevant Code Snippets (after addressing the issues):

// Set session options
store.Options = &sessions.Options{
    Domain:   "localhost",
    Path:     "/",
    MaxAge:   3600 * 8, // 8 hours
    HttpOnly: true,
}

// Session handling in `SessionHandler`
func SessionHandler(res http.ResponseWriter, req *http.Request) {
    session, err := store.Get(req, "loginSession")
    if err != nil {
        // Handle the error
    }

    // Check for a valid session
    if session.Values["email"] == nil {
        http.Redirect(res, req, "html/login.html", http.StatusFound)
    } else {
        http.Redirect(res, req, "html/home.html", http.StatusFound)
    }
}