Simple Session Management in Go

Session management is crucial for maintaining state across multiple requests in web applications. This challenge asks you to implement a basic session management system in Go using cookies to store session IDs and a simple in-memory store for session data. This will allow you to track user activity and preferences across different pages.

Problem Description

You are tasked with creating a simple session management system in Go. The system should:

1. Generate Session IDs: Upon a user's first request, generate a unique session ID (a random string) and store it in a cookie named "session_id" in the user's browser.
2. Store Session Data: Maintain an in-memory map (or similar data structure) to store session data, keyed by the session ID.
3. Retrieve Session Data: For subsequent requests, retrieve the session ID from the "session_id" cookie. Use this ID to look up and retrieve the session data from the in-memory store.
4. Update Session Data: Allow updating the session data associated with a given session ID.
5. Destroy Session: Provide a mechanism to destroy a session (remove the session ID from the cookie and the session data from the in-memory store).

The system should handle the following:

• New Sessions: Correctly generate and store session IDs for new users.
• Existing Sessions: Correctly retrieve and update session data for returning users.
• Session Expiration (Simulated): For simplicity, you don't need to implement actual expiration. However, consider how you would handle expiration if you were to extend this system.
• Cookie Security: While not required for this basic implementation, be mindful of cookie security best practices (e.g., HttpOnly, Secure flags) in a real-world application.
• Error Handling: Handle cases where a session ID is missing or invalid gracefully.

Examples

Example 1:

Input: Initial request (no session_id cookie)
Output: HTTP response with a "session_id" cookie set to a random value (e.g., "abc123xyz") and an empty session data map associated with that ID.
Explanation: A new session is created, a unique ID is generated, stored in a cookie, and an empty session is created in memory.

Example 2:

Input: Subsequent request with "session_id" cookie set to "abc123xyz" and session data {"username": "john.doe"}
Output: HTTP response with the same "session_id" cookie and the session data {"username": "john.doe"}.
Explanation: The session ID is retrieved from the cookie, the corresponding session data is retrieved from memory, and the response reflects that data.

Example 3:

Input: Request with "session_id" cookie set to "abc123xyz" followed by a request to update the session data to {"username": "john.doe", "theme": "dark"}
Output: HTTP response with the same "session_id" cookie and the updated session data {"username": "john.doe", "theme": "dark"}.
Explanation: The session ID is retrieved, the existing session data is retrieved, updated with the new data, and the updated data is stored back in memory.

Example 4:

Input: Request with a "session_id" cookie that doesn't exist in the session store.
Output: HTTP response indicating an error (e.g., a 400 Bad Request) or a new session is created.  The behavior here is up to you, but should be consistent.
Explanation: The session ID is invalid, and the system should handle this gracefully.

Constraints

• Session ID Length: Session IDs should be at least 32 characters long.
• In-Memory Store: The session data must be stored in memory. Persistence is not required for this challenge.
• Cookie Size: Be mindful of cookie size limits. Avoid storing excessively large amounts of data in the cookie itself.
• Performance: The session lookup and update operations should be reasonably efficient for a small number of concurrent users (e.g., O(1) lookup).
• Randomness: Use a cryptographically secure random number generator for session ID generation.

Notes

• You can use the crypto/rand package for generating random session IDs.
• Consider using a map[string]map[string]string] to store session data, where the outer key is the session ID and the inner map stores key-value pairs for session attributes.
• This is a simplified implementation. Real-world session management systems often involve more sophisticated features like session expiration, persistence, and security measures.
• Focus on the core functionality of session ID generation, storage, retrieval, and destruction. Error handling and edge cases are important to consider.
• Think about how you would extend this system to handle session expiration and persistence to a database.