Cookies and state between pages

The hardware and bandwidth for this mirror is donated by dogado GmbH, the Webhosting and Full Service-Cloud Provider. Check out our Wordpress Tutorial.
If you wish to report a bug, or if you are interested in having us mirror your free-software or open-source project, please feel free to contact us at mirror[@]dogado.de.

Every page of a brochure app is a new Shiny session. Nothing computed on one page survives a navigation to another. That is deliberate, and it means state shared between pages has to be written down somewhere: a cookie, and usually a backend keyed by what the cookie holds.

Setting a cookie

A cookie is a response header, so it is set from a res_handler:

page(
  href = "/login",
  ui = tagList(h1("You are logged in")),
  res_handlers = list(
    ~ set_cookie(.x, "SESSION", "a-random-id", path = "/")
  )
)

set_cookie() defaults to http_only = TRUE and same_site = "Lax", so the cookie is not readable from javascript, and is kept off cross-site subrequests — an image, a form post, a fetch from another site. "Lax" is not total isolation: the cookie still travels when someone follows a link to your app from elsewhere, which is what makes it usable for a session at all. Use same_site = "Strict" if even that is too much. Pass secure = TRUE in production, where the app is served over https.

Names and values are checked against the character set cookies allow. A value carrying a ;, a newline or a quote is rejected rather than silently truncating the header or, worse, appending one of its own.

Reading it back

From a page server:

server <- function(input, output, session) {
  cookies <- parse_cookie_string(get_cookies())
  print(cookies["SESSION"])
}

Index with single brackets: a request carrying no Cookie header at all gives nothing to index into, and [[ raises “subscript out of bounds” where [ returns NA.

get_cookies() gives the raw Cookie header; parse_cookie_string() turns it into a named vector.

Removing it

page(
  href = "/logout",
  ui = tagList(h1("You are logged out")),
  res_handlers = list(
    ~ remove_cookie(.x, "SESSION", path = "/")
  )
)

Pass remove_cookie() the same path and domain you gave set_cookie(). A browser only replaces a cookie when the name, the path and the domain all match; with a different path it files the deletion as a separate cookie and leaves the original alone. This bites hardest behind a reverse proxy, where the default path is the mount rather than /, so the deletion appears to work locally and does nothing once deployed.

A session across pages

The cookie holds an identifier; the data lives server side, keyed by it.

store <- cachem::cache_disk()

# 32 hex characters from the system's cryptographic source. `sample()` would
# read from R's default generator, whose state is recoverable from its output:
# fine for a simulation, not for something that has to be unguessable.
new_session_id <- function() {
  paste(
    sprintf("%02x", as.integer(openssl::rand_bytes(16))),
    collapse = ""
  )
}

login <- function() {
  page(
    href = "/login",
    ui = tagList(h1("Welcome back")),
    res_handlers = list(
      # Runs once per request, so each visitor gets an identifier of their own.
      # Building it in `login()` instead would run it once, when the app is
      # assembled, and hand every visitor the same session.
      function(res, req) {
        id <- new_session_id()
        store$set(id, list(user = "colin", at = Sys.time()))
        set_cookie(res, "SESSION", id, path = "/")
      }
    )
  )
}

home <- function() {
  page(
    href = "/",
    ui = tagList(h1("Home"), verbatimTextOutput("who")),
    server = function(input, output, session) {
      output$who <- renderPrint({
        # Single brackets: with no Cookie header at all there is nothing to
        # index into, and `[[` would raise "subscript out of bounds" before
        # the fallback below is reached.
        id <- parse_cookie_string(get_cookies())["SESSION"]
        if (is.na(id)) "anonymous" else store$get(id)
      })
    }
  )
}

The store is what decides what a session may do; the cookie only names it. So the identifier has to be unguessable, and it has to be minted per visitor — two mistakes that are easy to make and silent when made.

These binaries (installable software) and packages are in development.
They may not be fully stable and should be used with caution. We make no claims about them.
Health stats visible at Monitor.