TASK
Implementation
Sessions store authentication state server-side. After login, the server creates a session record keyed by a random ID and sends that ID to the client as a cookie. On every subsequent request, the client presents the ID and the server looks up the session.
Implement a node that manages server-side sessions:
// Create a new session after successful login
{ "type": "create_session", "msg_id": 1, "user_id": "user123" }
-> { "type": "session_created", "in_reply_to": 1,
"session_id": "<crypto-random-uuid>",
"expires_at": <unix-timestamp> }
// Validate a session cookie on incoming request
{ "type": "validate_session", "msg_id": 2, "session_id": "abc123" }
-> { "type": "session_valid", "in_reply_to": 2,
"user_id": "user123", "expires_in": 3600 }
// Regenerate session ID after privilege change (prevents fixation)
{ "type": "regenerate_session", "msg_id": 3, "old_session_id": "abc123" }
-> { "type": "session_regenerated", "in_reply_to": 3,
"new_session_id": "<new-uuid>" }
// Destroy session on logout
{ "type": "destroy_session", "msg_id": 4, "session_id": "abc123" }
-> { "type": "session_destroyed", "in_reply_to": 4,
"message": "Session destroyed" }Sample Test Cases
Create sessionTimeout: 5000ms
Input
{
"src": "auth",
"dest": "session",
"body": {
"type": "create_session",
"msg_id": 1,
"user_id": "user123"
}
}Expected Output
{"type": "session_created", "in_reply_to": 1, "session_id": ".*", "expires_at": ".*"}Validate sessionTimeout: 5000ms
Input
{
"src": "api",
"dest": "session",
"body": {
"type": "validate_session",
"msg_id": 1,
"session_id": "abc123"
}
}Expected Output
{"type": "session_valid", "in_reply_to": 1, "user_id": "user123", "expires_in": 3600}Hints
Hint 1▾
Session ID must be cryptographically random (use uuid or similar)
Hint 2▾
validate_session returns user_id and expires_in from the stored session
Hint 3▾
regenerate_session creates a NEW random session_id and copies all session data to it
Hint 4▾
destroy_session removes the session from storage permanently
Hint 5▾
Session expiry: track created_at + ttl; return session_invalid if expired
OVERVIEW
Theoretical Hub
Concept overview coming soon
Key Concepts
sessionsession IDsession fixationsession expirysession storage
main.py
python
1
2
3
4
5
6
7
8
9
10
11
12
13
#!/usr/bin/env python3
import sys
import json
def main():
# Your implementation here
for line in sys.stdin:
msg = json.loads(line)
print(json.dumps(msg), flush=True)
if __name__ == "__main__":
main()