[eliasjpr]

Summary

Phase 0, item 12 of the plan (first part): requests shared one session through the store.

A Store is shared by every request but held the session in a single current_session field. Reproduced with a failing spec:

1. Request 1 carries Alice's session cookie, so the store's current_session becomes Alice's.
2. Request 2 has no cookie. load_from finds nothing to load, so current_session stays Alice's, and set_cookies answers with a Set-Cookie carrying Alice's session id.

So a visitor with no cookie was handed the previous user's session. Concurrent requests overwrote each other's session the same way.

Fix

• Store keeps the current session per fiber (current_session, current_session=, release). The four stores no longer define their own field.
• SessionHandler calls release when the request ends (ensure), so a keep-alive connection's next request starts fresh, unless its cookie names a stored session.

Specs

spec/request_isolation_spec.cr has two examples:

• a visitor without a cookie does not get the previous visitor's session id (red before the change);
• two concurrent requests, forced to interleave, each see their own session.

Full suite: 395 examples, 0 failures on Crystal 1.22.0. crystal tool format --check is clean.

Not in this PR

• @flash is also one instance shared by all requests, so flash messages can reach another user. It needs to live in the session data, which changes the Flash API.
• CookieStore#cookies is shared per-request state of the same kind.
• regenerate_id on authentication, refusing the default secret outside development, and a real client binding (validate_session_binding is a stub) remain from the plan.

---

Generated by Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}