I was interested in bolt and how this session store is set up. By implementing my own session store, I found a serious bug in the reap fuction in reaper.go file line 63:

if options.BatchSize == i {
   copy(prevKey, k)
   return nil
}

prevKey will always be nil, because copy will do the following thing:

The copy built-in function copies elements from a source slice into a destination slice. (As a special case, it also will copy bytes from a string to a slice of bytes.) The source and destination may overlap. Copy returns the number of elements copied, which WILL BE THE MINIMUM of len(src) and len(dst).

The reaper will always scan the first few database values until the BatchSize is reached. During the next reap process, the reaper should continue at the last key, but instead it will start from the beginning again.

A possible fix would be the following;

if options.BatchSize == i {
   // Store the current key to the previous key.
   // Copy the byte slice key, because this data is
   // not safe outside of this transaction.
   prevKey = make([]byte, len(k))
   copy(prevKey, k)
   return nil
}

Greetings

Please batch all those bold database write transactions into one single transaction to improve performance:

Sequential write performance is also fast but random writes can be slow. You can add a write-ahead log or transaction coalescer in front of Bolt to mitigate this issue.

Don't remove each expired session in a new transaction. Cache all expired session IDs into a byte slice and remove them all at once in a single transaction.

if shared.Expired(session) {
   err := db.Update(func(txu *bolt.Tx) error {
      return txu.Bucket(options.BucketName).Delete(k)
   })
}

I would also consider to remove the unnecessary database transaction in store.go line 90. Just return an error. The expired session will be removed from the reaper anyway. This will improve the bolt database performance.

Greetings

Anyone is using this for production?

In using this at scale I see a hang in load() around line 90.
I'm now testing a version that puts Update() after View():

func (s *Store) load(session *sessions.Session) (bool, error) {
	// exists represents whether a session data exists or not.
	var exists, expired bool
	id := []byte(session.ID)
	err := s.db.View(func(tx *bolt.Tx) error {
		bucket := tx.Bucket(s.config.DBOptions.BucketName)
		// Get the session data.
		data := bucket.Get(id)
		if data == nil {
			return nil
		}
		sessionData, err := shared.Session(data)
		if err != nil {
			return err
		}
		// Check the expiration of the session data.
		if shared.Expired(sessionData) {
			expired = true
		}
		exists = true
		dec := gob.NewDecoder(bytes.NewBuffer(sessionData.Values))
		return dec.Decode(&session.Values)
	})
	if expired {
		err := s.db.Update(func(txu *bolt.Tx) error {
			return txu.Bucket(s.config.DBOptions.BucketName).Delete(id)
		})
		return false, err
	}
	return exists, err
}

Hi @yosssi, thanks a lot for the great package.
While using it, I stumbled upon the issue with code.google.com/p/gogoprotobuf.
I saw that it had been fixed in master, but Go Modules default to the nearest release version.
Is it reasonable to cut a new minor version in order for Go Modules to default to that?

Hi @yosssi! Again, thanks a lot for this package, it has been very useful to us for this project:
https://github.com/arrikto/oidc-authservice

A new need has come up to do additional work before a session is reaped.
For example, we need to revoke tokens at a remote endpoint.
I have prepared and will open a PR for this functionality, if you are willing to accept.
I understand that you may not have the time to help, in which case we would have to use our own fork.

In terms to manage Options outside boltstore, it would be nice to have either config public or enable a method to update those values.

Doesn't work with CoreOS fork of boltdb. More specifically, reaper.Run() doesn't work.