Redis-Cached Session Context & Responsive S3 Images

Overview

Server-rendered SaaS applications need two things on every page load: the identity and permissions of the current user, and any dynamic assets (like profile images or uploaded content) rendered at the right resolution for the visitor’s device. A web application solves both problems through template helpers that hydrate a ContextUser and ContextAccount from Redis-backed session IDs and lazily generate responsive S3 image URLs via an img_resize helper that produces cached srcset attributes for server-rendered HTML.

The session layer works as follows: when a user logs in, the server creates a session ID, stores the user’s profile and account data in Redis under that key with a TTL, and sets a signed cookie containing the session ID. On subsequent requests, middleware reads the cookie, fetches the session data from Redis, and populates the template context with ContextUser (name, email, role, permissions) and ContextAccount (plan, quota, feature flags). Template helpers access these objects directly, avoiding a database round-trip on every page render.

The image pipeline addresses a different performance concern. User-uploaded images stored in S3 are often multi-megabyte originals. Serving them directly wastes bandwidth and makes pages slow on mobile. The img_resize template helper generates URLs for an image resizing service (or S3-backed Lambda@Edge function) at multiple widths and assembles them into an HTML srcset attribute. The generated srcset is cached in Redis so that repeated renders of the same image don’t recompute the URL list. The browser then selects the appropriately sized image based on the viewport width and device pixel ratio.

Core Concepts

How It Works

Session Middleware

The session middleware runs on every request. It reads the session cookie, fetches the session data from Redis, and populates the request context with the user and account objects. If the session is missing or expired, the context contains a nil user, and templates render the logged-out state.

package middleware

import (
    "context"
    "encoding/json"
    "net/http"
    "time"

    "github.com/redis/go-redis/v9"
)

type SessionData struct {
    UserID      string   `json:"user_id"`
    Email       string   `json:"email"`
    Name        string   `json:"name"`
    Role        string   `json:"role"`
    AccountID   string   `json:"account_id"`
    AccountPlan string   `json:"account_plan"`
    Features    []string `json:"features"`
}

type ContextUser struct {
    ID    string
    Email string
    Name  string
    Role  string
}

func (u *ContextUser) IsAdmin() bool {
    return u.Role == "admin" || u.Role == "owner"
}

type ContextAccount struct {
    ID       string
    Plan     string
    Features map[string]bool
}

func (a *ContextAccount) CanAccessFeature(name string) bool {
    return a.Features[name]
}

func SessionMiddleware(rdb *redis.Client) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            cookie, err := r.Cookie("session_id")
            if err != nil {
                next.ServeHTTP(w, r)
                return
            }

            sessionID, err := verifySignedCookie(cookie.Value)
            if err != nil {
                next.ServeHTTP(w, r)
                return
            }

            raw, err := rdb.Get(r.Context(), "session:"+sessionID).Bytes()
            if err != nil {
                next.ServeHTTP(w, r)
                return
            }

            var data SessionData
            if err := json.Unmarshal(raw, &data); err != nil {
                next.ServeHTTP(w, r)
                return
            }

            // Refresh TTL on active sessions
            rdb.Expire(r.Context(), "session:"+sessionID, 24*time.Hour)

            featureMap := make(map[string]bool, len(data.Features))
            for _, f := range data.Features {
                featureMap[f] = true
            }

            ctx := r.Context()
            ctx = context.WithValue(ctx, userCtxKey, &ContextUser{
                ID: data.UserID, Email: data.Email,
                Name: data.Name, Role: data.Role,
            })
            ctx = context.WithValue(ctx, accountCtxKey, &ContextAccount{
                ID: data.AccountID, Plan: data.AccountPlan,
                Features: featureMap,
            })

            next.ServeHTTP(w, r.WithContext(ctx))
        })
    }
}

Session Creation on Login

When a user authenticates successfully, the login handler creates a session in Redis and sets the signed cookie. The session data includes everything the templates need so that subsequent requests avoid database queries.

func handleLogin(rdb *redis.Client) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        email := r.FormValue("email")
        password := r.FormValue("password")

        user, account, err := authenticateUser(email, password)
        if err != nil {
            http.Error(w, "Invalid credentials", http.StatusUnauthorized)
            return
        }

        sessionID := generateSecureRandomID(32)

        data := SessionData{
            UserID:      user.ID,
            Email:       user.Email,
            Name:        user.Name,
            Role:        user.Role,
            AccountID:   account.ID,
            AccountPlan: account.Plan,
            Features:    account.EnabledFeatures,
        }

        raw, _ := json.Marshal(data)
        rdb.Set(r.Context(), "session:"+sessionID, raw, 24*time.Hour)

        signed := signCookie(sessionID)
        http.SetCookie(w, &http.Cookie{
            Name:     "session_id",
            Value:    signed,
            Path:     "/",
            HttpOnly: true,
            Secure:   true,
            SameSite: http.SameSiteLaxMode,
            MaxAge:   86400,
        })

        http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
    }
}

Responsive Image Template Helper

The img_resize template function generates a complete <img> tag with srcset and sizes attributes. It checks Redis for a cached srcset string before generating one, and caches the result for future renders.

package helpers

import (
    "context"
    "fmt"
    "html/template"
    "strings"
    "time"

    "github.com/redis/go-redis/v9"
)

var defaultWidths = []int{320, 640, 960, 1280, 1920}

type ImageHelper struct {
    rdb       *redis.Client
    cdnBase   string
    s3Bucket  string
}

func (h *ImageHelper) ImgResize(s3Key, alt, sizes string) template.HTML {
    cacheKey := fmt.Sprintf("srcset:%s:%v", s3Key, defaultWidths)

    cached, err := h.rdb.Get(context.Background(), cacheKey).Result()
    if err == nil {
        return template.HTML(fmt.Sprintf(
            `<img srcset="%s" sizes="%s" src="%s" alt="%s" loading="lazy">`,
            cached, sizes, h.imageURL(s3Key, 960), alt,
        ))
    }

    var parts []string
    for _, w := range defaultWidths {
        url := h.imageURL(s3Key, w)
        parts = append(parts, fmt.Sprintf("%s %dw", url, w))
    }
    srcset := strings.Join(parts, ", ")

    h.rdb.Set(context.Background(), cacheKey, srcset, 6*time.Hour)

    return template.HTML(fmt.Sprintf(
        `<img srcset="%s" sizes="%s" src="%s" alt="%s" loading="lazy">`,
        srcset, sizes, h.imageURL(s3Key, 960), alt,
    ))
}

func (h *ImageHelper) imageURL(s3Key string, width int) string {
    return fmt.Sprintf("%s/resize/%d/%s/%s", h.cdnBase, width, h.s3Bucket, s3Key)
}

func TemplateFuncMap(rdb *redis.Client, cdnBase, bucket string) template.FuncMap {
    helper := &ImageHelper{rdb: rdb, cdnBase: cdnBase, s3Bucket: bucket}
    return template.FuncMap{
        "img_resize": helper.ImgResize,
    }
}

Using Helpers in Templates

Server-rendered templates access the session context and image helper directly. The template engine receives the context user and account as part of the template data, and the img_resize function is registered in the template function map.

{{/* dashboard.html */}}
{{ if .User }}
  <nav>
    <span>Welcome, {{ .User.Name }}</span>
    {{ if .User.IsAdmin }}
      <a href="/admin">Admin Panel</a>
    {{ end }}
    {{ if .Account.CanAccessFeature "advanced-search" }}
      <a href="/search/advanced">Advanced Search</a>
    {{ end }}
    <span class="plan-badge">{{ .Account.Plan }}</span>
  </nav>

  <div class="profile">
    {{ img_resize .User.AvatarKey "Profile photo" "(max-width: 600px) 100vw, 300px" }}
  </div>

  <div class="gallery">
    {{ range .Documents }}
      <div class="card">
        {{ img_resize .ThumbnailKey .Title "(max-width: 600px) 50vw, 25vw" }}
        <h3>{{ .Title }}</h3>
      </div>
    {{ end }}
  </div>
{{ else }}
  <a href="/login">Sign In</a>
{{ end }}

Practical Applications

The web app demonstrates a session architecture that scales horizontally without sticky sessions. Because all session state lives in Redis rather than in-process memory, any application server can handle any request. Load balancers can distribute traffic purely on health and capacity, and deploying a new server version is a rolling restart with zero session loss. The TTL-based expiration in Redis eliminates the need for a session cleanup cron job—expired sessions simply vanish.

The responsive image pipeline reduces page weight by 60-80% on mobile devices without requiring developers to manually create multiple image sizes. The img_resize helper is a single function call in the template that handles URL generation, caching, and HTML output. When the CDN or image service URL format changes, a single code change in the helper propagates to every image on every page. The Redis cache prevents URL generation from becoming a bottleneck on pages with many images.

The combination of these two patterns creates a fast, consistent server-rendered experience. Every page load fetches the session from Redis (sub-millisecond), hydrates the user and account context, and renders templates that include optimally-sized images. The total server-side rendering time stays under 10ms even on pages with complex permission checks and dozens of images, because the hot data is always in Redis and the image URLs are cached.

Implementation Patterns

Session Data Denormalization

The session stores denormalized user and account data (name, email, plan, features) rather than just a user ID. This eliminates a database query on every request at the cost of potentially stale data. When the user updates their profile or the account plan changes, the application must update the session in Redis as well as the database. A helper function refreshSession(ctx, userID) fetches fresh data from the database and overwrites the Redis session, keeping both stores consistent.

Signed URL Rotation for S3 Images

If the image resizing service uses S3 presigned URLs, those URLs expire after a configured period. The Redis cache TTL for srcset strings must be shorter than the presigned URL expiration to prevent serving expired URLs. A common configuration is 1-hour presigned URLs with a 45-minute cache TTL, giving a 15-minute buffer. Public buckets behind CloudFront don’t need signed URLs and can use longer cache TTLs.

Graceful Degradation on Redis Failure

If Redis is unavailable, the session middleware should not crash the application. Instead, it should treat the request as unauthenticated (no session found) and let the page render in the logged-out state. Similarly, the image helper should fall back to the original S3 URL at a default width rather than returning an error. This degradation is transparent to the user on public pages and results in a login prompt on authenticated pages.

Common Pitfalls

• Session fixation attacks: After successful authentication, always generate a new session ID rather than reusing the pre-login session ID. Reusing the ID allows an attacker who set the cookie before login to hijack the authenticated session.
• Stale session data after role changes: If an admin revokes a user’s admin role, the change won’t take effect until the session is refreshed or expires. For security-critical role changes, actively delete or update the affected session in Redis immediately rather than waiting for natural expiration.
• Image cache key collisions: If the cache key doesn’t include the target widths, changing the default widths array serves stale srcset strings with the old widths until the cache expires. Always include the widths in the cache key, or invalidate the cache when the configuration changes.
• Missing sizes attribute on img tags: A srcset without a sizes attribute defaults to 100vw, causing the browser to always download the largest image. Always provide a sizes attribute that reflects the image’s actual display size in the layout.
• Redis connection pool exhaustion: High-traffic pages that render many images can make dozens of Redis calls per request (one per image for cache lookups). Use a pipelined or batched Redis call to fetch all cache entries in a single round trip, reducing connection usage and latency.