Session

Session Management in TeaLeaf

TeaLeaf provides a lightweight built-in session system that allows you to persist data between requests per user, without depending on external libraries or databases.

---

How it works internally

When a new client connects, TeaLeaf:

1. Generates a unique session ID (UID).
2. Stores a Python dictionary associated with that UID on the server.
3. Sends a cookie to the client containing the session UID.
4. For every subsequent request, TeaLeaf retrieves the stored session object using that cookie.

The result is a simple but powerful mechanism to maintain per-user state.

The Session object

TeaLeaf sessions are represented by the Session class, which behaves like a Python dictionary but also supports attribute-style access.

store.has(attr) # check if attr exists in the store return True or False
store[attr] = value # set the attr to value
store[attr] # returns the value , throw exception if attr not exist in the store

Function route , session injection

if store exists as an argument in the function for a route, TeaLeaf will inject the store automatically

@app.route("/login")
def login(session, req: HttpRequest):
    user = req.form()
    if not user or "userName" not in user:
        return "401 unauthorized"

    # Store user data in the session
    session.userName = user["userName"]
    return redirect("/")

Security notes

• Sessions are identified only by a cookie; if the cookie is deleted, the session resets.
• Currently, sessions are not persisted (they live only in server memory).

Future features:

• Persisting sessions
• Session expiration time
• Signed/encrypted cookies