Authboss

The remember module uses cookie storage to log users in without an active session.

Middleware Setup

You must include both LoadClientStateMiddleware and remember.Middleware in your middleware stack. To ensure client state is available to Authboss mechanisms, remember.Middleware must be placed after LoadClientStateMiddleware. Because it manages session-less logins, it should be placed high up in the stack.

Storage Requirements

• Client Storage: Uses Session and Cookies.
• Server Storage: Requires a RememberingServerStorer. Note that this storer typically requires a separate database table to save tokens to a PID, as it does not use the standard User struct.

Handling 'Half-Authed' Users

Users logged in via Remember tokens are considered "half-authed". You can check for this state using the session key authboss.SessionHalfAuthKey.

To prevent half-authed users from accessing sensitive routes (e.g., changing user details), use the forceFullAuth boolean flag on the authboss.Middleware to protect those routes.

The register module allows users to self-register. To prevent data loss when validation fails (e.g., a password doesn't meet requirements), use RegisterPreserveFields to whitelist fields that should be kept in the session.

Requirements:

• Module: register
• Routes: /register
• Middleware: LoadClientStateMiddleware
• Client Storage: Session
• Server Storer: CreatingServerStorer
• User Interface: AuthableUser (and optionally ArbitraryUser for extra fields)
• Values: UserValuer (and optionally ArbitraryValuer)

Preserving Fields in Templates: When registration fails, whitelisted values are stored in the data key authboss.DataPreserve as a map[string]string. In your templates, access these using .preserve.field_name. Always use {{with ...}} to avoid errors if the map is empty or nil.

Example template usage:

{{with .preserve.username}}
  <input type="text" name="username" value="{{ . }}">
{{end}}