Umbral Sessions

HTTP forgets you the moment the response is sent. Sessions are how your app remembers — the signed-in user, a half-filled cart, a flash message that should survive one redirect. Umbral Sessions gives you a server-side store (persisted through the ORM, so no extra infrastructure to stand up) plus the cookie middleware that ties each browser to its row, with secure defaults already switched on.

Install

cargo add umbral-sessions

Wire it up

Add it before anything that reads the session — auth, in particular.

use umbral::prelude::*;
use umbral_sessions::SessionsPlugin;

let app = App::builder()
    .database("default", pool)
    .plugin(SessionsPlugin::default())
    .plugin(AuthPlugin::<AuthUser>::default())  // reads the session
    .build()?;

Target: stash something across requests

The session is a typed key/value bag that outlives a single request.

use umbral_sessions::Session;

async fn add_to_cart(session: Session) {
    let mut cart: Vec<i64> = session.get("cart").await.unwrap_or_default();
    cart.push(product_id);
    session.insert("cart", &cart).await;
}

What you get

• DB-backed session store — no Redis required to start
• Cookie middleware with secure, HttpOnly defaults
• The foundation umbral-auth's login / logout builds on
• Redis-backed store on the roadmap for horizontal scaling