// the find
Kwynto/gosession
This is quick session for net/http in golang. This package is perhaps the best implementation of the session mechanism, at least it tries to become one.
gosession is an in-memory session store for Go's standard net/http, nothing more. It handles cookie creation, session ID generation, get/set/remove/destroy operations, and a background goroutine that purges expired sessions. If you're building a small Go web app and don't want to pull in gorilla/sessions, this is a reasonable choice.
The API is genuinely minimal — Start(), Set(), Get(), Remove(), Destroy() covers everything without ceremony. StartSecure() rotating session IDs on each access is a nice touch for hijacking resistance. The package is a single file with no dependencies outside the standard library. Test coverage is solid and the benchmarks are included, which at least shows the author thought about performance.
All sessions live in a global in-memory map, so this dies instantly in any multi-instance or restarted deployment — no persistence, no distributed store, no pluggable backend. The Get() return type is interface{}, meaning every read requires a type assertion with no help from generics despite Go 1.18+ being available for years now. There's been no commit since July 2024 and the feature set is frozen at the basics, so if you need flash messages, CSRF tokens, or anything beyond raw key-value storage you're writing it yourself. The 'perhaps the best implementation' claim in the README is doing a lot of heavy lifting for what is essentially a thin wrapper around a sync.RWMutex and a map.