Learning Fiber - Sessions and Authentication

#Introduction

Not all authentication uses JWT. Classic web applications — with login forms and server-side pages — typically use sessions. Episode 19 covers sessions in Fiber v3: creating a store, storing data between requests, custom types, Redis storage, and a complete authentication flow.

Sessions keep state on the server and give the client an identity cookie. They're easier to revoke than JWT (logout takes effect immediately). With github.com/gofiber/storage, session data can be shared across instances — important when the app runs on many servers.

#Creating a Session Store

#Setting Up the Store and Middleware

The store is created once, then installed as middleware:

import "github.com/gofiber/fiber/v3/middleware/session"
 
store := session.New(session.Config{
    Expiration: 24 * time.Hour,
})
 
app.Use(store.Middleware())

session.New(session.Config{Expiration: 24h}) creates a store with a 24-hour lifetime. store.Middleware() wraps every request: the middleware reads the session cookie (if present) and provides the active session through the context. Every handler can access the session without creating its own.

#Cookie Configuration

The session cookie needs secure settings:

store := session.New(session.Config{
    Expiration:  24 * time.Hour,
    KeyLookup:   "cookie:session_id",
    CookieHTTPOnly: true,
    CookieSecure: true,
    CookieSameSite: "Lax",
})

KeyLookup: "cookie:session_id" sets the cookie name. CookieHTTPOnly, CookieSecure, and CookieSameSite protect the cookie from JavaScript and cross-site usage. In development, CookieSecure can be turned off because HTTPS isn't available yet.

#Reading and Writing Sessions

#Get, Set, and Save

Session data is accessed through the object provided by the middleware:

app.Post("/login", func(c fiber.Ctx) error {
    sess := session.FromContext(c)
    sess.Set("user_id", 42)
    sess.Set("role", "admin")
    return sess.Save()
})
 
app.Get("/me", func(c fiber.Ctx) error {
    sess := session.FromContext(c)
    id := sess.Get("user_id")
    return c.JSON(fiber.Map{"user_id": id})
})

session.FromContext(c) retrieves the session from the context (provided by the middleware). sess.Set(key, value) writes data, sess.Get(key) reads it, and sess.Save() saves — it must be called for changes to actually persist to the cookie and storage.

#Destroying Sessions

Logout means deleting the session:

app.Post("/logout", func(c fiber.Ctx) error {
    sess := session.FromContext(c)
    if err := sess.Destroy(); err != nil {
        return err
    }
    return c.JSON(fiber.Map{"message": "logout berhasil"})
})

sess.Destroy() deletes the session data and marks the cookie for client removal. Unlike JWT, session logout takes effect immediately — the data is already gone from the server. Make sure Save/Destroy are called before the handler returns a response.

#Custom Types

#Registering Types with the Store

By default sessions store simple values. Custom structs must be registered first:

type UserProfile struct {
    Name  string
    Email string
}
 
func init() {
    session.RegisterType(UserProfile{})
}
app.Get("/profile", func(c fiber.Ctx) error {
    sess := session.FromContext(c)
    profile := sess.Get("profile").(UserProfile)
    return c.JSON(profile)
})

session.RegisterType(UserProfile{}) tells the encoder how to handle that struct when stored in a session. Without registration, sess.Get("profile") will fail to return the struct correctly. Register all custom types in init() so they're always ready before the server starts.

#Centralized Storage

#Redis Storage

By default sessions are stored in memory — lost on server restart and not shareable between instances. For production, use centralized storage:

import (
    "github.com/gofiber/storage/redis/v3"
    "github.com/gofiber/fiber/v3/middleware/session"
)
 
storage := redis.New(redis.Config{
    Host:     "localhost",
    Port:     6379,
    Username: "",
    Password: "",
    Database: 0,
})
 
store := session.New(session.Config{
    Storage:    storage,
    Expiration: 24 * time.Hour,
})

session.Config{Storage: storage} replaces the default storage. Redis makes sessions survive restarts and shared across server instances — a requirement for load balancing. Other storage options are available in github.com/gofiber/storage: Memcache, MySQL, PostgreSQL, SQLite, and more, with similar configuration.

#The Complete Authentication Flow

#Login, Protection, and Logout

All the pieces come together:

app.Post("/login", func(c fiber.Ctx) error {
    var creds Credentials
    if err := c.Bind().JSON(&creds); err != nil {
        return err
    }
    if creds.Username != "budi" || creds.Password != "rahasia123" {
        return fiber.NewError(fiber.StatusUnauthorized, "kredensial salah")
    }
    sess := session.FromContext(c)
    sess.Set("username", creds.Username)
    return sess.Save()
})
 
app.Get("/dashboard", requireAuth, func(c fiber.Ctx) error {
    return c.JSON(fiber.Map{"message": "selamat datang"})
})
 
func requireAuth(c fiber.Ctx) error {
    sess := session.FromContext(c)
    if sess.Get("username") == nil {
        return fiber.NewError(fiber.StatusUnauthorized, "harus login")
    }
    return c.Next()
}

Login writes username to the session after verification. requireAuth — attached as route middleware — checks the data's presence; if empty, the request is rejected with 401. Logout calls Destroy. This pattern is simple, easy to audit, and safe against logout.

#Testing

curl -i -c cookies.txt -X POST -H "Content-Type: application/json" \
  --data '{"username":"budi","password":"rahasia123"}' http://localhost:3000/login
 
curl -i -b cookies.txt http://localhost:3000/dashboard

#Closing

Key takeaways:

• session.New(session.Config{Expiration, ...}) creates a store; store.Middleware() provides a per-request session.
• session.FromContext(c) retrieves the session; you must call Save() for changes to persist.
• sess.Get/Set/Destroy read, write, and delete session data.
• session.RegisterType(MyStruct{}) registers custom structs for storage.
• session.Config{Storage: ...} uses centralized storage like github.com/gofiber/storage/redis/v3.
• Session authentication: write data at login, check it in route middleware, Destroy() at logout.

In the next episode, episode 20, we discuss rate limiting and throttling — the limiter middleware with Redis, sliding windows, and how to protect APIs from attacks and abuse.