diff --git a/.eslintignore b/.eslintignore
index 62562b74..76b1021d 100644
--- a/.eslintignore
+++ b/.eslintignore
@@ -1,2 +1,3 @@
+.nyc_output
coverage
node_modules
diff --git a/.eslintrc.yml b/.eslintrc.yml
index e48de5ea..b6b9f62f 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -1,7 +1,15 @@
root: true
+extends:
+ - plugin:markdown/recommended
+plugins:
+ - markdown
+overrides:
+ - files: '**/*.md'
+ processor: 'markdown/markdown'
rules:
eol-last: error
- indent: ["error", 2, { "SwitchCase": 1 }]
+ eqeqeq: ["error", "always", { "null": "ignore" }]
+ indent: ["error", 2, { "MemberExpression": "off", "SwitchCase": 1 }]
no-mixed-spaces-and-tabs: error
no-trailing-spaces: error
one-var: ["error", { "initialized": "never" }]
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..7d2c7033
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+ - package-ecosystem: github-actions
+ directory: /
+ schedule:
+ interval: monthly
+ groups:
+ github-actions:
+ patterns:
+ - "*"
+
+ - package-ecosystem: npm
+ directory: /
+ schedule:
+ interval: monthly
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+ groups:
+ npm-dependencies:
+ patterns:
+ - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..004c35ed
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,264 @@
+name: ci
+
+on:
+- pull_request
+- push
+
+permissions:
+ contents: read
+
+jobs:
+ test:
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ name:
+ - Node.js 0.8
+ - Node.js 0.10
+ - Node.js 0.12
+ - io.js 1.x
+ - io.js 2.x
+ - io.js 3.x
+ - Node.js 4.x
+ - Node.js 5.x
+ - Node.js 6.x
+ - Node.js 7.x
+ - Node.js 8.x
+ - Node.js 9.x
+ - Node.js 10.x
+ - Node.js 11.x
+ - Node.js 12.x
+ - Node.js 13.x
+ - Node.js 14.x
+ - Node.js 15.x
+ - Node.js 16.x
+ - Node.js 17.x
+ - Node.js 18.x
+ - Node.js 19.x
+ - Node.js 20.x
+ - Node.js 21.x
+ - Node.js 22.x
+ - Node.js 23.x
+ - Node.js 24.x
+ - Node.js 25.x
+
+ include:
+ - name: Node.js 0.8
+ node-version: "0.8"
+ npm-i: mocha@2.5.3 supertest@1.1.0
+ npm-rm: nyc
+
+ - name: Node.js 0.10
+ node-version: "0.10"
+ npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
+
+ - name: Node.js 0.12
+ node-version: "0.12"
+ npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
+
+ - name: io.js 1.x
+ node-version: "1.8"
+ npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
+
+ - name: io.js 2.x
+ node-version: "2.5"
+ npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
+
+ - name: io.js 3.x
+ node-version: "3.3"
+ npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
+
+ - name: Node.js 4.x
+ node-version: "4.9"
+ npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+ - name: Node.js 5.x
+ node-version: "5.12"
+ npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+ - name: Node.js 6.x
+ node-version: "6.17"
+ npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
+
+ - name: Node.js 7.x
+ node-version: "7.10"
+ npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
+
+ - name: Node.js 8.x
+ node-version: "8.17"
+ npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6
+
+ - name: Node.js 9.x
+ node-version: "9.11"
+ npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6
+
+ - name: Node.js 10.x
+ node-version: "10.24"
+ npm-i: mocha@8.4.0 supertest@6.1.6
+
+ - name: Node.js 11.x
+ node-version: "11.15"
+ npm-i: mocha@8.4.0 supertest@6.1.6
+
+ - name: Node.js 12.x
+ node-version: "12.22"
+ npm-i: mocha@9.2.2 supertest@6.1.6
+
+ - name: Node.js 13.x
+ node-version: "13.14"
+ npm-i: mocha@9.2.2 supertest@6.1.6
+
+ - name: Node.js 14.x
+ node-version: "14.21"
+
+ - name: Node.js 15.x
+ node-version: "15.14"
+ npm-i: supertest@6.1.6
+
+ - name: Node.js 16.x
+ node-version: "16.20"
+
+ - name: Node.js 17.x
+ node-version: "17.9"
+
+ - name: Node.js 18.x
+ node-version: "18.19"
+
+ - name: Node.js 19.x
+ node-version: "19.9"
+
+ - name: Node.js 20.x
+ node-version: "20"
+
+ - name: Node.js 21.x
+ node-version: "21"
+
+ - name: Node.js 22.x
+ node-version: "22"
+
+ - name: Node.js 23.x
+ node-version: "23"
+
+ - name: Node.js 24.x
+ node-version: "24"
+
+ - name: Node.js 25.x
+ node-version: "25"
+
+ steps:
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+ - name: Install Node.js ${{ matrix.node-version }}
+ shell: bash -eo pipefail -l {0}
+ run: |
+ nvm install --default ${{ matrix.node-version }}
+ if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+ nvm install --alias=npm 0.10
+ nvm use ${{ matrix.node-version }}
+ if [[ "$(npm -v)" == 1.1.* ]]; then
+ nvm exec npm npm install -g npm@1.1
+ ln -fs "$(which npm)" "$(dirname "$(nvm which npm)")/npm"
+ else
+ sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
+ fi
+ npm config set strict-ssl false
+ fi
+ dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
+
+ - name: Configure npm
+ run: |
+ if [[ "$(npm config get package-lock)" == "true" ]]; then
+ npm config set package-lock false
+ else
+ npm config set shrinkwrap false
+ fi
+
+ - name: Remove npm module(s) ${{ matrix.npm-rm }}
+ run: npm rm --silent --save-dev ${{ matrix.npm-rm }}
+ if: matrix.npm-rm != ''
+
+ - name: Install npm module(s) ${{ matrix.npm-i }}
+ run: npm install --save-dev ${{ matrix.npm-i }}
+ if: matrix.npm-i != ''
+
+ - name: Setup Node.js version-specific dependencies
+ shell: bash
+ run: |
+ # eslint for linting
+ # - remove on Node.js < 12
+ if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then
+ node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
+ grep -E '^eslint(-|$)' | \
+ sort -r | \
+ xargs -n1 npm rm --silent --save-dev
+ fi
+
+ - name: Install Node.js dependencies
+ run: npm install
+
+ - name: List environment
+ id: list_env
+ shell: bash
+ run: |
+ echo "node@$(node -v)"
+ echo "npm@$(npm -v)"
+ npm -s ls ||:
+ (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
+
+ - name: Run tests
+ shell: bash
+ run: |
+ if npm -ps ls nyc | grep -q nyc; then
+ npm run test-ci
+ cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov"
+ else
+ npm test
+ fi
+
+ - name: Lint code
+ if: steps.list_env.outputs.eslint != ''
+ run: npm run lint
+
+ - name: Collect code coverage
+ if: steps.list_env.outputs.nyc != ''
+ run: |
+ if [[ -d ./coverage ]]; then
+ mv ./coverage "./${{ matrix.node-version }}"
+ mkdir ./coverage
+ mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}"
+ fi
+
+ - name: Upload code coverage
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ if: steps.list_env.outputs.nyc != ''
+ with:
+ name: coverage-${{ matrix.node-version }}
+ path: "./coverage/${{ matrix.node-version }}"
+ retention-days: 1
+
+ coverage:
+ permissions:
+ checks: write # for coverallsapp/github-action to create new checks
+ contents: read # for actions/checkout to fetch code
+ needs: test
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+ - name: Install lcov
+ shell: bash
+ run: sudo apt-get -y install lcov
+
+ - name: Collect coverage reports
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ path: ./coverage
+
+ - name: Merge coverage reports
+ shell: bash
+ run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
+
+ - name: Upload coverage report
+ uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # master
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..139ec706
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,66 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+ push:
+ branches: ["master"]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: ["master"]
+ schedule:
+ - cron: "0 0 * * 1"
+
+permissions:
+ contents: read
+
+jobs:
+ analyze:
+ name: Analyze
+ runs-on: ubuntu-latest
+ permissions:
+ actions: read
+ contents: read
+ security-events: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+ # Initializes the CodeQL tools for scanning.
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+ with:
+ languages: javascript
+ # If you wish to specify custom queries, you can do so here or in a config file.
+ # By default, queries listed here will override any specified in a config file.
+ # Prefix the list here with "+" to use these queries and those in the config file.
+
+ # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
+ # If this step fails, then you should remove it and run the build manually (see below)
+ # - name: Autobuild
+ # uses: github/codeql-action/autobuild@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+
+ # âšī¸ Command-line programs to run using the OS shell.
+ # đ See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+ # If the Autobuild fails above, remove it and uncomment the following three lines.
+ # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+ # - run: |
+ # echo "Run, Build Application using script"
+ # ./location_of_script_within_repo/buildscript.sh
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+ with:
+ category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 00000000..2bb15b23
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+
+on:
+ # For Branch-Protection check. Only the default branch is supported. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+ branch_protection_rule:
+ # To guarantee Maintained check is occasionally updated. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+ schedule:
+ - cron: '16 21 * * 1'
+ push:
+ branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ permissions:
+ # Needed to upload the results to code-scanning dashboard.
+ security-events: write
+ # Needed to publish results and get a badge (see publish_results below).
+ id-token: write
+ # Uncomment the permissions below if installing in a private repository.
+ # contents: read
+ # actions: read
+
+ steps:
+ - name: "Checkout code"
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false
+
+ - name: "Run analysis"
+ uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+ # - you want to enable the Branch-Protection check on a *public* repository, or
+ # - you are installing Scorecard on a *private* repository
+ # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+ # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+ # Public repositories:
+ # - Publish results to OpenSSF REST API for easy access by consumers
+ # - Allows the repository to include the Scorecard badge.
+ # - See https://github.com/ossf/scorecard-action#publishing-results.
+ # For private repositories:
+ # - `publish_results` will always be set to `false`, regardless
+ # of the value entered here.
+ publish_results: true
+
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+ # format to the repository Actions tab.
+ - name: "Upload artifact"
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ # Upload the results to GitHub's code scanning dashboard.
+ - name: "Upload to code-scanning"
+ uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+ with:
+ sarif_file: results.sarif
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 84a48637..1b6fef23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,7 @@
+.nyc_output
coverage
node_modules
npm-debug.log
package-lock.json
+/test/fixtures/server.crt
+/test/fixtures/server.key
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index e84788db..00000000
--- a/.travis.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-language: node_js
-node_js:
- - "0.8"
- - "0.10"
- - "0.12"
- - "1.8"
- - "2.5"
- - "3.3"
- - "4.9"
- - "5.12"
- - "6.14"
- - "7.10"
- - "8.12"
- - "9.11"
- - "10.13"
-sudo: false
-cache:
- directories:
- - node_modules
-before_install:
- # Configure npm
- - |
- # Skip updating shrinkwrap / lock
- npm config set shrinkwrap false
- # Setup Node.js version-specific dependencies
- - |
- # eslint for linting
- # - remove on Node.js < 4
- if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
- node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
- grep -E '^eslint(-|$)' | \
- xargs npm rm --save-dev
- fi
- - |
- # istanbul for coverage
- # - remove on Node.js < 0.10
- if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
- npm rm --save-dev istanbul
- fi
- - |
- # mocha for testing
- # - use 2.x for Node.js < 0.10
- # - use 3.x for Node.js < 6
- if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
- npm install --save-dev mocha@2.5.3
- elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
- npm install --save-dev mocha@3.5.3
- fi
- - |
- # supertest for http calls
- # - use 1.1.0 for Node.js < 0.10
- # - use 2.0.0 for Node.js < 4
- if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
- npm install --save-dev supertest@1.1.0
- elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
- npm install --save-dev supertest@2.0.0
- fi
- # Update Node.js modules
- - |
- # Prune & rebuild node_modules
- if [[ -d node_modules ]]; then
- npm prune
- npm rebuild
- fi
-
-script:
- - |
- # Run test script, depending on istanbul install
- if [[ -n "$(npm -ps ls istanbul)" ]]; then
- npm run-script test-travis
- else
- npm test
- fi
- - |
- # Run linting, depending on eslint install
- if [[ -n "$(npm -ps ls eslint)" ]]; then
- npm run-script lint
- fi
-after_script:
- - |
- # Upload coverage to coveralls, if exists
- if [[ -f ./coverage/lcov.info ]]; then
- npm install --save-dev coveralls@2
- coveralls < ./coverage/lcov.info
- fi
diff --git a/HISTORY.md b/HISTORY.md
index d9ca7e60..251d5fa7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,90 @@
unreleased
==========
+ * Enforce RFC 6265 section 5.1.4 path matching for the session cookie path
+ * Fix `secure: 'auto'` and `sameSite: 'auto'` not being resolved when `cookie` is a function
+
+1.19.0 / 2026-01-22
+==========
+
+ * Add dynamic cookie options support
+ * Add sameSite 'auto' support for automatic SameSite attribute configuration
+ * deps: use tilde notation for dependencies
+
+1.18.2 / 2025-07-17
+==========
+ * deps: mocha@10.8.2
+ * deps: on-headers@~1.1.0
+ - Fix [CVE-2025-7339](https://www.cve.org/CVERecord?id=CVE-2025-7339) ([GHSA-76c9-3jph-rj3q](https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q))
+
+1.18.1 / 2024-10-08
+==========
+
+ * deps: cookie@0.7.2
+ - Fix object assignment of `hasOwnProperty`
+ * deps: cookie@0.7.1
+ - Allow leading dot for domain
+ - Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
+ - Add fast path for `serialize` without options, use `obj.hasOwnProperty` when parsing
+ * deps: cookie@0.7.0
+ - perf: parse cookies ~10% faster
+ - fix: narrow the validation of cookies to match RFC6265
+ - fix: add `main` to `package.json` for rspack
+
+1.18.0 / 2024-01-28
+===================
+
+ * Add debug log for pathname mismatch
+ * Add `partitioned` to `cookie` options
+ * Add `priority` to `cookie` options
+ * Fix handling errors from setting cookie
+ * Support any type in `secret` that `crypto.createHmac` supports
+ * deps: cookie@0.6.0
+ - Fix `expires` option to reject invalid dates
+ - perf: improve default decode speed
+ - perf: remove slow string split in parse
+ * deps: cookie-signature@1.0.7
+
+1.17.3 / 2022-05-11
+===================
+
+ * Fix resaving already-saved new session at end of request
+ * deps: cookie@0.4.2
+
+1.17.2 / 2021-05-19
+===================
+
+ * Fix `res.end` patch to always commit headers
+ * deps: cookie@0.4.1
+ * deps: safe-buffer@5.2.1
+
+1.17.1 / 2020-04-16
+===================
+
+ * Fix internal method wrapping error on failed reloads
+
+1.17.0 / 2019-10-10
+===================
+
+ * deps: cookie@0.4.0
+ - Add `SameSite=None` support
+ * deps: safe-buffer@5.2.0
+
+1.16.2 / 2019-06-12
+===================
+
+ * Fix restoring `cookie.originalMaxAge` when store returns `Date`
+ * deps: parseurl@~1.3.3
+
+1.16.1 / 2019-04-11
+===================
+
+ * Fix error passing `data` option to `Cookie` constructor
+ * Fix uncaught error from bad session data
+
+1.16.0 / 2019-04-10
+===================
+
* Catch invalid `cookie.maxAge` value earlier
* Deprecate setting `cookie.maxAge` to a `Date` object
* Fix issue where `resave: false` may not save altered sessions
@@ -11,6 +95,8 @@ unreleased
- Replace internal `eval` usage with `Function` constructor
- Use instance methods on `process` to check for listeners
- perf: remove argument reassignment
+ * deps: on-headers@~1.0.2
+ - Fix `res.writeHead` patch missing return value
1.15.6 / 2017-09-26
===================
@@ -99,7 +185,7 @@ unreleased
- Improve error message when `expires` is not a `Date`
- perf: enable strict mode
- perf: use for loop in parse
- - perf: use string concatination for serialization
+ - perf: use string concatenation for serialization
* deps: parseurl@~1.3.1
- perf: enable strict mode
* deps: uid-safe@~2.1.1
diff --git a/README.md b/README.md
index 2be21d2c..162ea14d 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
[![NPM Version][npm-version-image]][npm-url]
[![NPM Downloads][npm-downloads-image]][node-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][ci-image]][ci-url]
[![Test Coverage][coveralls-image]][coveralls-url]
## Installation
@@ -49,6 +49,26 @@ For a list of stores, see [compatible session stores](#compatible-session-stores
Settings object for the session ID cookie. The default value is
`{ path: '/', httpOnly: true, secure: false, maxAge: null }`.
+In addition to providing a static object, you can also pass a callback function to dynamically generate the cookie options for each request. The callback receives the `req` object as its argument and should return an object containing the cookie settings.
+
+```js
+var app = express()
+app.use(session({
+ secret: 'keyboard cat',
+ resave: false,
+ saveUninitialized: true,
+ cookie: function(req) {
+ var match = req.url.match(/^\/([^/]+)/);
+ return {
+ path: match ? '/' + match[1] : '/',
+ httpOnly: true,
+ secure: req.secure || false,
+ maxAge: 60000
+ }
+ }
+}))
+```
+
The following are options that can be set in this object.
##### cookie.domain
@@ -89,26 +109,73 @@ no maximum age is set.
**Note** If both `expires` and `maxAge` are set in the options, then the last one
defined in the object is what is used.
+##### cookie.partitioned
+
+Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](rfc-cutler-httpbis-partitioned-cookies)
+attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
+By default, the `Partitioned` attribute is not set.
+
+**Note** This is an attribute that has not yet been fully standardized, and may
+change in the future. This also means many clients may ignore this attribute until
+they understand it.
+
+More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+
##### cookie.path
Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
is the root path of the domain.
+Since 1.19.1, path matching follows [RFC 6265 section 5.1.4][rfc-6265-5.1.4]. This means
+the session middleware will only activate when the request path is an exact match or falls
+under a segment boundary of the cookie path. For example, a cookie path of `/admin` will
+match `/admin` and `/admin/users` but will **not** match `/administrator`. Prior versions
+used a simple prefix check that did not enforce segment boundaries.
+
+##### cookie.priority
+
+Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1].
+
+ - `'low'` will set the `Priority` attribute to `Low`.
+ - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
+ - `'high'` will set the `Priority` attribute to `High`.
+
+More information about the different priority levels can be found in
+[the specification][rfc-west-cookie-priority-00-4.1].
+
+**Note** This is an attribute that has not yet been fully standardized, and may change in the future.
+This also means many clients may ignore this attribute until they understand it.
+
##### cookie.sameSite
Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
+By default, this is `false`.
- `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
- `false` will not set the `SameSite` attribute.
- `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+ - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
- `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+ - `'auto'` will set the `SameSite` attribute to `None` for secure connections and `Lax` for non-secure connections.
-More information about the different enforcement levels can be found in the specification
-https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1
+More information about the different enforcement levels can be found in
+[the specification][rfc-6265bis-03-4.1.2.7].
**Note** This is an attribute that has not yet been fully standardized, and may change in
the future. This also means many clients may ignore this attribute until they understand it.
+**Note** There is a [draft spec](https://tools.ietf.org/html/draft-west-cookie-incrementalism-01)
+that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been
+set to `'none'`. Some web browsers or other clients may be adopting this specification.
+
+The `cookie.sameSite` option can also be set to the special value `'auto'` to have
+this setting automatically match the determined security of the connection. When the connection
+is secure (HTTPS), the `SameSite` attribute will be set to `None` to enable cross-site usage.
+When the connection is not secure (HTTP), the `SameSite` attribute will be set to `Lax` for
+better security while maintaining functionality. This is useful when the Express `"trust proxy"`
+setting is properly setup to simplify development vs production configuration, particularly
+for SAML authentication scenarios.
+
##### cookie.secure
Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,
@@ -227,15 +294,24 @@ likely need `resave: true`.
##### rolling
-Force a session identifier cookie to be set on every response. The expiration
+Force the session identifier cookie to be set on every response. The expiration
is reset to the original [`maxAge`](#cookiemaxage), resetting the expiration
countdown.
The default value is `false`.
+With this enabled, the session identifier cookie will expire in
+[`maxAge`](#cookiemaxage) since the last response was sent instead of in
+[`maxAge`](#cookiemaxage) since the session was last modified by the server.
+
+This is typically used in conjunction with short, non-session-length
+[`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
+with reduced potential of it occurring during on going server interactions.
+
**Note** When this option is set to `true` but the `saveUninitialized` option is
set to `false`, the cookie will not be set on a response with an uninitialized
-session.
+session. This option only modifies the behavior when an existing session was
+loaded for the request.
##### saveUninitialized
@@ -259,10 +335,29 @@ it to be saved. *This has been fixed in PassportJS 0.3.0*
**Required option**
-This is the secret used to sign the session ID cookie. This can be either a string
-for a single secret, or an array of multiple secrets. If an array of secrets is
-provided, only the first element will be used to sign the session ID cookie, while
-all the elements will be considered when verifying the signature in requests.
+This is the secret used to sign the session ID cookie. The secret can be any type
+of value that is supported by Node.js `crypto.createHmac` (like a string or a
+`Buffer`). This can be either a single secret, or an array of multiple secrets. If
+an array of secrets is provided, only the first element will be used to sign the
+session ID cookie, while all the elements will be considered when verifying the
+signature in requests. The secret itself should be not easily parsed by a human and
+would best be a random set of characters. A best practice may include:
+
+ - The use of environment variables to store the secret, ensuring the secret itself
+ does not exist in your repository.
+ - Periodic updates of the secret, while ensuring the previous secret is in the
+ array.
+
+Using a secret that cannot be guessed will reduce the ability to hijack a session to
+only guessing the session ID (as determined by the `genid` option).
+
+Changing the secret value will invalidate all existing sessions. In order to rotate
+the secret without invalidating sessions, provide an array of secrets, with the new
+secret as first element of the array, and including previous secrets as the later
+elements.
+
+**Note** HMAC-256 is used to sign the session ID. For this reason, the secret should
+contain at least 32 bytes of entropy.
##### store
@@ -494,6 +589,11 @@ module. Please make a PR to add additional modules :)
[aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store
[aerospike-session-store-image]: https://badgen.net/github/stars/aerospike/aerospike-session-store-expressjs?label=%E2%98%85
+[![â
][better-sqlite3-session-store-image] better-sqlite3-session-store][better-sqlite3-session-store-url] A session store based on [better-sqlite3](https://github.com/JoshuaWise/better-sqlite3).
+
+[better-sqlite3-session-store-url]: https://www.npmjs.com/package/better-sqlite3-session-store
+[better-sqlite3-session-store-image]: https://badgen.net/github/stars/timdaub/better-sqlite3-session-store?label=%E2%98%85
+
[![â
][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
[cassandra-store-url]: https://www.npmjs.com/package/cassandra-store
@@ -506,6 +606,11 @@ and other multi-core embedded devices).
[cluster-store-url]: https://www.npmjs.com/package/cluster-store
[cluster-store-image]: https://badgen.net/github/stars/coolaj86/cluster-store?label=%E2%98%85
+[![â
][connect-arango-image] connect-arango][connect-arango-url] An ArangoDB-based session store.
+
+[connect-arango-url]: https://www.npmjs.com/package/connect-arango
+[connect-arango-image]: https://badgen.net/github/stars/AlexanderArvidsson/connect-arango?label=%E2%98%85
+
[![â
][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store.
[connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables
@@ -516,6 +621,11 @@ and other multi-core embedded devices).
[connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store
[connect-cloudant-store-image]: https://badgen.net/github/stars/adriantanasa/connect-cloudant-store?label=%E2%98%85
+[![â
][connect-cosmosdb-image] connect-cosmosdb][connect-cosmosdb-url] An Azure [Cosmos DB](https://azure.microsoft.com/en-us/products/cosmos-db/)-based session store.
+
+[connect-cosmosdb-url]: https://www.npmjs.com/package/connect-cosmosdb
+[connect-cosmosdb-image]: https://badgen.net/github/stars/thekillingspree/connect-cosmosdb?label=%E2%98%85
+
[![â
][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
[connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
@@ -538,24 +648,45 @@ and other multi-core embedded devices).
[![â
][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
-[connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
+[connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
[connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
+[![â
][@google-cloud/connect-firestore-image] @google-cloud/connect-firestore][@google-cloud/connect-firestore-url] A [Google Cloud Firestore](https://cloud.google.com/firestore/docs/overview)-based session store.
+
+[@google-cloud/connect-firestore-url]: https://www.npmjs.com/package/@google-cloud/connect-firestore
+[@google-cloud/connect-firestore-image]: https://badgen.net/github/stars/googleapis/nodejs-firestore-session?label=%E2%98%85
+
+[![â
][connect-hazelcast-image] connect-hazelcast][connect-hazelcast-url] Hazelcast session store for Connect and Express.
+
+[connect-hazelcast-url]: https://www.npmjs.com/package/connect-hazelcast
+[connect-hazelcast-image]: https://badgen.net/github/stars/huseyinbabal/connect-hazelcast?label=%E2%98%85
+
[![â
][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
[connect-loki-url]: https://www.npmjs.com/package/connect-loki
[connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
+[![â
][connect-lowdb-image] connect-lowdb][connect-lowdb-url] A lowdb-based session store.
+
+[connect-lowdb-url]: https://www.npmjs.com/package/connect-lowdb
+[connect-lowdb-image]: https://badgen.net/github/stars/travishorn/connect-lowdb?label=%E2%98%85
+
+[![â
][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
+
+[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
+[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
+
+[![â
][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
+[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
+
+[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
+[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
+
[![â
][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store.
[connect-ml-url]: https://www.npmjs.com/package/connect-ml
[connect-ml-image]: https://badgen.net/github/stars/bluetorch/connect-ml?label=%E2%98%85
-[![â
][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
-
-[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
-
[![â
][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
[connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
@@ -571,6 +702,21 @@ and other multi-core embedded devices).
[connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
[connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
+[![â
][connect-mssql-v2-image] connect-mssql-v2][connect-mssql-v2-url] A Microsoft SQL Server-based session store based on [connect-mssql](https://www.npmjs.com/package/connect-mssql).
+
+[connect-mssql-v2-url]: https://www.npmjs.com/package/connect-mssql-v2
+[connect-mssql-v2-image]: https://badgen.net/github/stars/jluboff/connect-mssql-v2?label=%E2%98%85
+
+[![â
][connect-neo4j-image] connect-neo4j][connect-neo4j-url] A [Neo4j](https://neo4j.com)-based session store.
+
+[connect-neo4j-url]: https://www.npmjs.com/package/connect-neo4j
+[connect-neo4j-image]: https://badgen.net/github/stars/MaxAndersson/connect-neo4j?label=%E2%98%85
+
+[![â
][connect-ottoman-image] connect-ottoman][connect-ottoman-url] A [couchbase ottoman](http://www.couchbase.com/)-based session store.
+
+[connect-ottoman-url]: https://www.npmjs.com/package/connect-ottoman
+[connect-ottoman-image]: https://badgen.net/github/stars/noiissyboy/connect-ottoman?label=%E2%98%85
+
[![â
][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
[connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
@@ -581,17 +727,6 @@ and other multi-core embedded devices).
[connect-redis-url]: https://www.npmjs.com/package/connect-redis
[connect-redis-image]: https://badgen.net/github/stars/tj/connect-redis?label=%E2%98%85
-[![â
][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
-
-[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
-[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
-
-[![â
][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
-[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
-
-[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
-[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
-
[![â
][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/)
[connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase
@@ -604,11 +739,21 @@ and other multi-core embedded devices).
[connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85
[![â
][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
-[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
+[Sequelize.js](https://sequelize.org/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
[connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
[connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
+[![â
][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
+
+[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
+[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
+
+[![â
][connect-typeorm-image] connect-typeorm][connect-typeorm-url] A [TypeORM](https://github.com/typeorm/typeorm)-based session store.
+
+[connect-typeorm-url]: https://www.npmjs.com/package/connect-typeorm
+[connect-typeorm-image]: https://badgen.net/github/stars/makepost/connect-typeorm?label=%E2%98%85
+
[![â
][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
[couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
@@ -619,38 +764,28 @@ and other multi-core embedded devices).
[dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
[dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
+[![â
][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
+
+[express-etcd-url]: https://www.npmjs.com/package/express-etcd
+[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
+
[![â
][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
[MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
[express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
[express-mysql-session-image]: https://badgen.net/github/stars/chill117/express-mysql-session?label=%E2%98%85
+[![â
][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
+
+[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
+[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
+
[![â
][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native
[oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module.
[express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session
[express-oracle-session-image]: https://badgen.net/github/stars/slumber86/express-oracle-session?label=%E2%98%85
-[![â
][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
-
-[express-sessions-url]: https://www.npmjs.com/package/express-sessions
-[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
-
-[![â
][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
-
-[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
-[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
-
-[![â
][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
-
-[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
-
-[![â
][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
-
-[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
-[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
-
[![â
][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url]
A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
@@ -658,24 +793,29 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
[express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager
[express-session-cache-manager-image]: https://badgen.net/github/stars/theogravity/express-session-cache-manager?label=%E2%98%85
+[![â
][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+
+[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
+[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
+
[![â
][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
[express-session-level-url]: https://www.npmjs.com/package/express-session-level
[express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
-[![â
][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
+[![â
][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerful, flat file database.
-[express-etcd-url]: https://www.npmjs.com/package/express-etcd
-[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
+[express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb
+[express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85
-[![â
][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+[![â
][express-sessions-image] express-sessions][express-sessions-url] A session store supporting both MongoDB and Redis.
-[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
-[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
+[express-sessions-url]: https://www.npmjs.com/package/express-sessions
+[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
[![â
][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store.
-[firestore-store-url]: https://github.com/hendrysadrak/firestore-store
+[firestore-store-url]: https://www.npmjs.com/package/firestore-store
[firestore-store-image]: https://badgen.net/github/stars/hendrysadrak/firestore-store?label=%E2%98%85
[![â
][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
@@ -692,7 +832,12 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
[![â
][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
[level-session-store-url]: https://www.npmjs.com/package/level-session-store
-[level-session-store-image]: https://badgen.net/github/stars/scriptollc/level-session-store?label=%E2%98%85
+[level-session-store-image]: https://badgen.net/github/stars/toddself/level-session-store?label=%E2%98%85
+
+[![â
][lowdb-session-store-image] lowdb-session-store][lowdb-session-store-url] A [lowdb](https://www.npmjs.com/package/lowdb)-based session store.
+
+[lowdb-session-store-url]: https://www.npmjs.com/package/lowdb-session-store
+[lowdb-session-store-image]: https://badgen.net/github/stars/fhellwig/lowdb-session-store?label=%E2%98%85
[![â
][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
@@ -714,12 +859,17 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
[nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
[nedb-session-store-image]: https://badgen.net/github/stars/JamesMGreene/nedb-session-store?label=%E2%98%85
+[![â
][@quixo3/prisma-session-store-image] @quixo3/prisma-session-store][@quixo3/prisma-session-store-url] A session store for the [Prisma Framework](https://www.prisma.io).
+
+[@quixo3/prisma-session-store-url]: https://www.npmjs.com/package/@quixo3/prisma-session-store
+[@quixo3/prisma-session-store-image]: https://badgen.net/github/stars/kleydon/prisma-session-store?label=%E2%98%85
+
[![â
][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API
[restsession-url]: https://www.npmjs.com/package/restsession
[restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85
-[![â
][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
+[![â
][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](https://sequelize.org/).
[sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
[sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85
@@ -734,10 +884,10 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
[session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
[session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
-[![â
][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
+[![â
][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
-[session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
-[session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
+[@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store
+[@databunker/session-store-image]: https://badgen.net/github/stars/securitybunker/databunker-session-store?label=%E2%98%85
[![â
][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases.
@@ -749,7 +899,9 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
[tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session
[tch-nedb-session-image]: https://badgen.net/github/stars/tomaschyly/NeDBSession?label=%E2%98%85
-## Example
+## Examples
+
+### View counter
A simple example using `express-session` to store page views for a user.
@@ -787,17 +939,120 @@ app.get('/foo', function (req, res, next) {
app.get('/bar', function (req, res, next) {
res.send('you viewed this page ' + req.session.views['/bar'] + ' times')
})
+
+app.listen(3000)
+```
+
+### User login
+
+A simple example using `express-session` to keep a user log in session.
+
+```js
+var escapeHtml = require('escape-html')
+var express = require('express')
+var session = require('express-session')
+
+var app = express()
+
+app.use(session({
+ secret: 'keyboard cat',
+ resave: false,
+ saveUninitialized: true
+}))
+
+// middleware to test if authenticated
+function isAuthenticated (req, res, next) {
+ if (req.session.user) next()
+ else next('route')
+}
+
+app.get('/', isAuthenticated, function (req, res) {
+ // this is only called when there is an authentication user due to isAuthenticated
+ res.send('hello, ' + escapeHtml(req.session.user) + '!' +
+ ' Logout')
+})
+
+app.get('/', function (req, res) {
+ res.send('')
+})
+
+app.post('/login', express.urlencoded({ extended: false }), function (req, res) {
+ // login logic to validate req.body.user and req.body.pass
+ // would be implemented here. for this example any combo works
+
+ // regenerate the session, which is good practice to help
+ // guard against forms of session fixation
+ req.session.regenerate(function (err) {
+ if (err) next(err)
+
+ // store user information in session, typically a user id
+ req.session.user = req.body.user
+
+ // save the session before redirection to ensure page
+ // load does not happen before session is saved
+ req.session.save(function (err) {
+ if (err) return next(err)
+ res.redirect('/')
+ })
+ })
+})
+
+app.get('/logout', function (req, res, next) {
+ // logout logic
+
+ // clear the user from the session object and save.
+ // this will ensure that re-using the old session id
+ // does not have a logged in user
+ req.session.user = null
+ req.session.save(function (err) {
+ if (err) next(err)
+
+ // regenerate the session, which is good practice to help
+ // guard against forms of session fixation
+ req.session.regenerate(function (err) {
+ if (err) next(err)
+ res.redirect('/')
+ })
+ })
+})
+
+app.listen(3000)
+```
+
+## Debugging
+
+This module uses the [debug](https://www.npmjs.com/package/debug) module
+internally to log information about session operations.
+
+To see all the internal logs, set the `DEBUG` environment variable to
+`express-session` when launching your app (`npm start`, in this example):
+
+```sh
+$ DEBUG=express-session npm start
+```
+
+On Windows, use the corresponding command;
+
+```sh
+> set DEBUG=express-session & npm start
```
## License
[MIT](LICENSE)
+[rfc-6265-5.1.4]: https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4
+[rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/
+[rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
+[ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
+[ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
[coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
[node-url]: https://nodejs.org/en/download
[npm-downloads-image]: https://badgen.net/npm/dm/express-session
[npm-url]: https://npmjs.org/package/express-session
[npm-version-image]: https://badgen.net/npm/v/express-session
-[travis-image]: https://badgen.net/travis/expressjs/session/master
-[travis-url]: https://travis-ci.org/expressjs/session
diff --git a/index.js b/index.js
index 42639913..3e23e901 100644
--- a/index.js
+++ b/index.js
@@ -70,7 +70,7 @@ var defer = typeof setImmediate === 'function'
* Setup session store with the given `options`.
*
* @param {Object} [options]
- * @param {Object} [options.cookie] Options for cookie
+ * @param {Object|Function} [options.cookie] Options for cookie
* @param {Function} [options.genid]
* @param {String} [options.name=connect.sid] Session ID cookie name
* @param {Boolean} [options.proxy]
@@ -150,7 +150,7 @@ function session(options) {
// notify user that this store is not
// meant for a production environment
/* istanbul ignore next: not tested */
- if ('production' == env && store instanceof MemoryStore) {
+ if (env === 'production' && store instanceof MemoryStore) {
console.warn(warning);
}
@@ -158,10 +158,17 @@ function session(options) {
store.generate = function(req){
req.sessionID = generateId(req);
req.session = new Session(req);
- req.session.cookie = new Cookie(cookieOptions);
+ var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions;
+ req.session.cookie = new Cookie(resolvedCookieOptions);
- if (cookieOptions.secure === 'auto') {
- req.session.cookie.secure = issecure(req, trustProxy);
+ var isSecure = issecure(req, trustProxy);
+
+ if (resolvedCookieOptions.secure === 'auto') {
+ req.session.cookie.secure = isSecure;
+ }
+
+ if (resolvedCookieOptions.sameSite === 'auto') {
+ req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
}
};
@@ -193,7 +200,15 @@ function session(options) {
// pathname mismatch
var originalPath = parseUrl.original(req).pathname || '/'
- if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next();
+ var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions
+ var cfgPath = resolvedCookieOptions.path || '/'
+
+ if (!rfcPathMatch(originalPath, cfgPath)) {
+ debug('pathname mismatch')
+ next()
+ return
+ }
+
// ensure a secret is available or bail
if (!secret && !req.secret) {
@@ -240,7 +255,11 @@ function session(options) {
}
// set cookie
- setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data);
+ try {
+ setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data)
+ } catch (err) {
+ defer(next, err)
+ }
});
// proxy end() to commit the session
@@ -272,6 +291,10 @@ function session(options) {
return ret;
}
+ if (!res._header) {
+ res._implicitHeader()
+ }
+
if (chunk == null) {
ret = true;
return ret;
@@ -363,6 +386,29 @@ function session(options) {
wrapmethods(req.session);
}
+ // inflate the session
+ function inflate (req, sess) {
+ store.createSession(req, sess)
+ originalId = req.sessionID
+ originalHash = hash(sess)
+
+ if (!resaveSession) {
+ savedHash = originalHash
+ }
+
+ wrapmethods(req.session)
+ }
+
+ function rewrapmethods (sess, callback) {
+ return function () {
+ if (req.session !== sess) {
+ wrapmethods(req.session)
+ }
+
+ callback.apply(this, arguments)
+ }
+ }
+
// wrap session methods
function wrapmethods(sess) {
var _reload = sess.reload
@@ -370,10 +416,7 @@ function session(options) {
function reload(callback) {
debug('reloading %s', this.id)
- _reload.call(this, function () {
- wrapmethods(req.session)
- callback.apply(this, arguments)
- })
+ _reload.call(this, rewrapmethods(this, callback))
}
function save() {
@@ -420,7 +463,7 @@ function session(options) {
return false;
}
- return !saveUninitializedSession && cookieId !== req.sessionID
+ return !saveUninitializedSession && !savedHash && cookieId !== req.sessionID
? isModified(req.session)
: !isSaved(req.session)
}
@@ -443,7 +486,7 @@ function session(options) {
return false;
}
- return cookieId != req.sessionID
+ return cookieId !== req.sessionID
? saveUninitializedSession || isModified(req.session)
: rollingSessions || req.session.cookie.expires != null && isModified(req.session);
}
@@ -460,38 +503,66 @@ function session(options) {
debug('fetching %s', req.sessionID);
store.get(req.sessionID, function(err, sess){
// error handling
- if (err) {
+ if (err && err.code !== 'ENOENT') {
debug('error %j', err);
+ next(err)
+ return
+ }
- if (err.code !== 'ENOENT') {
- next(err);
- return;
- }
-
- generate();
- // no session
- } else if (!sess) {
- debug('no session found');
- generate();
- // populate req.session
- } else {
- debug('session found');
- store.createSession(req, sess);
- originalId = req.sessionID;
- originalHash = hash(sess);
-
- if (!resaveSession) {
- savedHash = originalHash
+ try {
+ if (err || !sess) {
+ debug('no session found')
+ generate()
+ } else {
+ debug('session found')
+ inflate(req, sess)
}
-
- wrapmethods(req.session);
+ } catch (e) {
+ next(e)
+ return
}
- next();
+ next()
});
};
};
+/**
+ * Check if the cookiePath matches the requestPath following the
+ * rules in RFC 6265 section 5.1.4.
+ *
+ * @param {String} requestPath
+ * @param {String} cookiePath
+ * @return {Boolean}
+ * @private
+ */
+
+function rfcPathMatch(requestPath, cookiePath) {
+ // Normalize inputs (Node 0.8-safe)
+ requestPath = (typeof requestPath === 'string' && requestPath.length) ? requestPath : '/';
+ cookiePath = (typeof cookiePath === 'string' && cookiePath.length) ? cookiePath : '/';
+
+ // Root cookie matches everything
+ if (cookiePath === '/') return true;
+
+ // Exact match
+ if (requestPath === cookiePath) return true;
+
+ // Prefix match
+ if (requestPath.indexOf(cookiePath) === 0) {
+ // If cookiePath ends with '/', any longer requestPath is OK
+ if (cookiePath.charAt(cookiePath.length - 1) === '/') return true;
+
+ // Otherwise the next char after the prefix must be '/'
+ var nextChar = requestPath.length > cookiePath.length
+ ? requestPath.charAt(cookiePath.length)
+ : '';
+ return nextChar === '/';
+ }
+
+ return false;
+}
+
/**
* Generate a session ID for a new session.
*
@@ -499,7 +570,7 @@ function session(options) {
* @private
*/
-function generateSessionId(sess) {
+function generateSessionId() {
return uid(24);
}
@@ -522,7 +593,7 @@ function getcookie(req, name, secrets) {
raw = cookies[name];
if (raw) {
- if (raw.substr(0, 2) === 's:') {
+ if (raw.slice(0, 2) === 's:') {
val = unsigncookie(raw.slice(2), secrets);
if (val === false) {
@@ -549,7 +620,7 @@ function getcookie(req, name, secrets) {
raw = req.cookies[name];
if (raw) {
- if (raw.substr(0, 2) === 's:') {
+ if (raw.slice(0, 2) === 's:') {
val = unsigncookie(raw.slice(2), secrets);
if (val) {
@@ -606,7 +677,8 @@ function hash(sess) {
function issecure(req, trustProxy) {
// socket is https server
- if (req.connection && req.connection.encrypted) {
+ var socket = req.socket || req.connection;
+ if (socket && socket.encrypted) {
return true;
}
@@ -624,7 +696,7 @@ function issecure(req, trustProxy) {
var header = req.headers['x-forwarded-proto'] || '';
var index = header.indexOf(',');
var proto = index !== -1
- ? header.substr(0, index).toLowerCase().trim()
+ ? header.slice(0, index).toLowerCase().trim()
: header.toLowerCase().trim()
return proto === 'https';
diff --git a/package.json b/package.json
index 03d016eb..36387796 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "express-session",
- "version": "1.15.6",
+ "version": "1.19.0",
"description": "Simple session middleware for Express",
"author": "TJ Holowaychuk (http://tjholowaychuk.com)",
"contributors": [
@@ -8,40 +8,43 @@
"Joe Wagner "
],
"repository": "expressjs/session",
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
+ },
"license": "MIT",
"dependencies": {
- "cookie": "0.3.1",
- "cookie-signature": "1.0.6",
- "debug": "2.6.9",
+ "cookie": "~0.7.2",
+ "cookie-signature": "~1.0.7",
+ "debug": "~2.6.9",
"depd": "~2.0.0",
- "on-headers": "~1.0.1",
- "parseurl": "~1.3.2",
- "safe-buffer": "5.1.2",
+ "on-headers": "~1.1.0",
+ "parseurl": "~1.3.3",
+ "safe-buffer": "~5.2.1",
"uid-safe": "~2.1.5"
},
"devDependencies": {
"after": "0.8.2",
- "cookie-parser": "1.4.3",
- "eslint": "3.19.0",
- "eslint-plugin-markdown": "1.0.0-beta.6",
- "express": "4.16.4",
- "istanbul": "0.4.5",
- "mocha": "5.2.0",
- "supertest": "3.3.0"
+ "cookie-parser": "1.4.6",
+ "eslint": "8.56.0",
+ "eslint-plugin-markdown": "3.0.1",
+ "express": "4.17.3",
+ "mocha": "10.8.2",
+ "nyc": "15.1.0",
+ "supertest": "6.3.4"
},
"files": [
"session/",
- "HISTORY.md",
- "LICENSE",
"index.js"
],
"engines": {
"node": ">= 0.8.0"
},
"scripts": {
- "lint": "eslint --plugin markdown --ext js,md .",
- "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
- "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
- "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/"
+ "lint": "eslint . && node ./scripts/lint-readme.js",
+ "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --no-exit --reporter spec test/",
+ "test-ci": "nyc --reporter=lcov --reporter=text npm test",
+ "test-cov": "nyc npm test",
+ "version": "node scripts/version-history.js && git add HISTORY.md"
}
}
diff --git a/scripts/lint-readme.js b/scripts/lint-readme.js
new file mode 100644
index 00000000..f4c50d76
--- /dev/null
+++ b/scripts/lint-readme.js
@@ -0,0 +1,93 @@
+var assert = require('assert')
+var fs = require('fs')
+var path = require('path')
+
+var BADGE_STAR_LINK_REGEXP = /^https:\/\/badgen.net\/github\/stars\/[^/]+\/[^/]+?label=%E2%98%85$/
+var MARKDOWN_LINK_REGEXP = /^\[([^ \]]+)\]: ([^ ]+)$/
+var MARKDOWN_SECTION_REGEXP = /^#+ (.+)$/
+var NEWLINE_REGEXP = /\r?\n/
+var README_PATH = path.join(__dirname, '..', 'README.md')
+var README_CONTENTS = fs.readFileSync(README_PATH, 'utf-8')
+var STORE_HEADER_REGEXP = /^\[!\[â
\]\[([^ \]]+)\] ([^ \]]+)\]\[([^ \]]+)\](?: .+)?$/
+
+var header = null
+var lintedStores = false
+var section = null
+var state = 0
+
+README_CONTENTS.split(NEWLINE_REGEXP).forEach(function (line, lineidx) {
+ section = (MARKDOWN_SECTION_REGEXP.exec(line) || [])[1] || section
+
+ if (section === 'Compatible Session Stores') {
+ lintedStores = true
+
+ switch (state) {
+ case 0: // premble
+ if (line[0] !== '[') break
+ state = 1
+ case 1: // header
+ var prev = header
+
+ if (!(header = STORE_HEADER_REGEXP.exec(line))) {
+ expect(lineidx, 'session store header', line)
+ } else if (prev && prev[2].replace(/^[^/]+\//, '').localeCompare(header[2].replace(/^[^/]+\//, '')) > 0) {
+ expect(lineidx, (header[2] + ' to be alphabetically before ' + prev[2]), line)
+ state = 2
+ } else {
+ state = 2
+ }
+
+ break
+ case 2: // blank line
+ if (line && MARKDOWN_LINK_REGEXP.test(line)) {
+ expect(lineidx, 'blank line or wrapped description', line)
+ } else if (line === '') {
+ state = 3
+ }
+ break
+ case 3: // url link
+ var urlLink = MARKDOWN_LINK_REGEXP.exec(line)
+
+ if (!urlLink) {
+ expect(lineidx, 'link reference', line)
+ } else if (urlLink[1] !== header[3]) {
+ expect(lineidx, ('link name of ' + header[3]), line)
+ } else if (urlLink[2] !== ('https://www.npmjs.com/package/' + header[2])) {
+ expect(lineidx, ('link url of https://www.npmjs.com/package/' + header[2]), line)
+ } else {
+ state = 4
+ }
+
+ break
+ case 4: // image link
+ var imageLink = MARKDOWN_LINK_REGEXP.exec(line)
+
+ if (!imageLink) {
+ expect(lineidx, 'link reference', line)
+ } else if (imageLink[1] !== header[1]) {
+ expect(lineidx, ('link name of ' + header[1]), line)
+ } else if (!BADGE_STAR_LINK_REGEXP.test(imageLink[2])) {
+ expect(lineidx, ('link url to github stars badge'), line)
+ } else {
+ state = 5
+ }
+
+ break
+ case 5: // blank line
+ if (line !== '') {
+ expect(lineidx, 'blank line after links', line)
+ } else {
+ state = 1
+ }
+ break
+ }
+ }
+})
+
+assert.ok(lintedStores, 'Compatible Session Stores section linted')
+
+function expect (lineidx, message, line) {
+ console.log('Expected %s on line %d', message, (lineidx + 1))
+ console.log(' Got: %s', line)
+ process.exitCode = 1
+}
diff --git a/scripts/version-history.js b/scripts/version-history.js
new file mode 100644
index 00000000..c58268ad
--- /dev/null
+++ b/scripts/version-history.js
@@ -0,0 +1,63 @@
+'use strict'
+
+var fs = require('fs')
+var path = require('path')
+
+var HISTORY_FILE_PATH = path.join(__dirname, '..', 'HISTORY.md')
+var MD_HEADER_REGEXP = /^====*$/
+var VERSION = process.env.npm_package_version
+var VERSION_PLACEHOLDER_REGEXP = /^(?:unreleased|(\d+\.)+x)$/
+
+var historyFileLines = fs.readFileSync(HISTORY_FILE_PATH, 'utf-8').split('\n')
+
+if (!MD_HEADER_REGEXP.test(historyFileLines[1])) {
+ console.error('Missing header in HISTORY.md')
+ process.exit(1)
+}
+
+if (!VERSION_PLACEHOLDER_REGEXP.test(historyFileLines[0])) {
+ console.error('Missing placeholder version in HISTORY.md')
+ process.exit(1)
+}
+
+if (historyFileLines[0].indexOf('x') !== -1) {
+ var versionCheckRegExp = new RegExp('^' + historyFileLines[0].replace('x', '.+') + '$')
+
+ if (!versionCheckRegExp.test(VERSION)) {
+ console.error('Version %s does not match placeholder %s', VERSION, historyFileLines[0])
+ process.exit(1)
+ }
+}
+
+historyFileLines[0] = VERSION + ' / ' + getLocaleDate()
+historyFileLines[1] = repeat('=', historyFileLines[0].length)
+
+fs.writeFileSync(HISTORY_FILE_PATH, historyFileLines.join('\n'))
+
+function getLocaleDate () {
+ var now = new Date()
+
+ return zeroPad(now.getFullYear(), 4) + '-' +
+ zeroPad(now.getMonth() + 1, 2) + '-' +
+ zeroPad(now.getDate(), 2)
+}
+
+function repeat (str, length) {
+ var out = ''
+
+ for (var i = 0; i < length; i++) {
+ out += str
+ }
+
+ return out
+}
+
+function zeroPad (number, length) {
+ var num = number.toString()
+
+ while (num.length < length) {
+ num = '0' + num
+ }
+
+ return num
+}
diff --git a/session/cookie.js b/session/cookie.js
index 1dd9bf95..8bb5907b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -33,13 +33,15 @@ var Cookie = module.exports = function Cookie(options) {
}
for (var key in options) {
- this[key] = options[key]
+ if (key !== 'data') {
+ this[key] = options[key]
+ }
}
}
- this.originalMaxAge = undefined == this.originalMaxAge
- ? this.maxAge
- : this.originalMaxAge;
+ if (this.originalMaxAge === undefined || this.originalMaxAge === null) {
+ this.originalMaxAge = this.maxAge
+ }
};
/*!
@@ -87,7 +89,7 @@ Cookie.prototype = {
deprecate('maxAge as Date; pass number of milliseconds instead')
}
- this.expires = 'number' == typeof ms
+ this.expires = typeof ms === 'number'
? new Date(Date.now() + ms)
: ms;
},
@@ -114,7 +116,9 @@ Cookie.prototype = {
get data() {
return {
- originalMaxAge: this.originalMaxAge
+ originalMaxAge: this.originalMaxAge,
+ partitioned: this.partitioned,
+ priority: this.priority
, expires: this._expires
, secure: this.secure
, httpOnly: this.httpOnly
diff --git a/session/memory.js b/session/memory.js
index 25252b6c..11ed686c 100644
--- a/session/memory.js
+++ b/session/memory.js
@@ -171,14 +171,16 @@ function getSession(sessionId) {
// parse
sess = JSON.parse(sess)
- var expires = typeof sess.cookie.expires === 'string'
- ? new Date(sess.cookie.expires)
- : sess.cookie.expires
-
- // destroy expired session
- if (expires && expires <= Date.now()) {
- delete this.sessions[sessionId]
- return
+ if (sess.cookie) {
+ var expires = typeof sess.cookie.expires === 'string'
+ ? new Date(sess.cookie.expires)
+ : sess.cookie.expires
+
+ // destroy expired session
+ if (expires && expires <= Date.now()) {
+ delete this.sessions[sessionId]
+ return
+ }
}
return sess
diff --git a/session/store.js b/session/store.js
index 00f3ac41..3793877e 100644
--- a/session/store.js
+++ b/session/store.js
@@ -85,11 +85,18 @@ Store.prototype.load = function(sid, fn){
Store.prototype.createSession = function(req, sess){
var expires = sess.cookie.expires
- var orig = sess.cookie.originalMaxAge
+ var originalMaxAge = sess.cookie.originalMaxAge
sess.cookie = new Cookie(sess.cookie);
- if ('string' == typeof expires) sess.cookie.expires = new Date(expires);
- sess.cookie.originalMaxAge = orig;
+
+ if (typeof expires === 'string') {
+ // convert expires to a Date object
+ sess.cookie.expires = new Date(expires)
+ }
+
+ // keep originalMaxAge intact
+ sess.cookie.originalMaxAge = originalMaxAge
+
req.session = new Session(req, sess);
return req.session;
};
diff --git a/test/cookie.js b/test/cookie.js
index 4cca87bb..ea676e35 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -12,11 +12,6 @@ describe('new Cookie()', function () {
assert.strictEqual(cookie.expires, null)
})
- it('should default maxAge to null', function () {
- var cookie = new Cookie()
- assert.strictEqual(cookie.maxAge, null)
- })
-
it('should default httpOnly to true', function () {
var cookie = new Cookie()
assert.strictEqual(cookie.httpOnly, true)
@@ -44,6 +39,15 @@ describe('new Cookie()', function () {
assert.throws(function () { new Cookie(function () {}) }, /argument options/)
})
+ it('should ignore "data" option', function () {
+ var cookie = new Cookie({ data: { foo: 'bar' }, path: '/foo' })
+
+ assert.strictEqual(typeof cookie, 'object')
+ assert.strictEqual(typeof cookie.data, 'object')
+ assert.strictEqual(cookie.data.path, '/foo')
+ assert.notStrictEqual(cookie.data.foo, 'bar')
+ })
+
describe('expires', function () {
it('should set expires', function () {
var expires = new Date(Date.now() + 60000)
@@ -82,7 +86,9 @@ describe('new Cookie()', function () {
var maxAge = 60000
var cookie = new Cookie({ maxAge: maxAge })
- assert.strictEqual(cookie.maxAge, maxAge)
+ assert.strictEqual(typeof cookie.maxAge, 'number')
+ assert.ok(cookie.maxAge - 1000 <= maxAge)
+ assert.ok(cookie.maxAge + 1000 >= maxAge)
})
it('should accept Date object', function () {
@@ -101,6 +107,14 @@ describe('new Cookie()', function () {
})
})
+ describe('partitioned', function () {
+ it('should set partitioned', function () {
+ var cookie = new Cookie({ partitioned: true })
+
+ assert.strictEqual(cookie.partitioned, true)
+ })
+ })
+
describe('path', function () {
it('should set path', function () {
var cookie = new Cookie({ path: '/foo' })
@@ -108,5 +122,13 @@ describe('new Cookie()', function () {
assert.strictEqual(cookie.path, '/foo')
})
})
+
+ describe('priority', function () {
+ it('should set priority', function () {
+ var cookie = new Cookie({ priority: 'high' })
+
+ assert.strictEqual(cookie.priority, 'high')
+ })
+ })
})
})
diff --git a/test/fixtures/.gitkeep b/test/fixtures/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
deleted file mode 100644
index c019198a..00000000
--- a/test/fixtures/server.crt
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICMzCCAZwCCQCJTms0qcIZgDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJV
-UzEQMA4GA1UECBMHSW5kaWFuYTEdMBsGA1UEChMUbm9kZS1leHByZXNzLXNlc3Np
-b24xHjAcBgNVBAMTFWV4cHJlc3Mtc2Vzc2lvbi5sb2NhbDAeFw0xNDExMjMwNTQ3
-MzlaFw0yNDExMjAwNTQ3MzlaMF4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdJbmRp
-YW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mtc2Vzc2lvbjEeMBwGA1UEAxMVZXhw
-cmVzcy1zZXNzaW9uLmxvY2FsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY
-G398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/XshTQWDKFfUbb/kmni
-DazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJax2l3yPJsWnB/8mrY
-cdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBADi0XXsZlQAKxOyD4qvdJNWJXlfqhr1q53dZmfF7nikDaMDiMspczTS/
-pxNbq2UaMc7g+6qmXPaPQoN3laQQtMdyVfSh6EIJHbzXXzdcCT4fDBYX7iwvh0Gg
-DUpjmxmCzFCaob9+hZzwbJi5MFQ4Qq12LW1aYHMs8wgLboHml1WL
------END CERTIFICATE-----
diff --git a/test/fixtures/server.key b/test/fixtures/server.key
deleted file mode 100644
index dabf2b83..00000000
--- a/test/fixtures/server.key
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDYG398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/Xs
-hTQWDKFfUbb/kmniDazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJa
-x2l3yPJsWnB/8mrYcdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQAB
-AoGBALB8HGw/kPA1Ay3Qc6/qCADWYvW8BcM/nQUmMkO3sUW/R5gTYPIMglHzdKIU
-aL9kwcXTZ0HIT4ZCCUffzF/cdD0lqCZjwGl0aM4xUZcPbaM/KmZOUcP92ymsN+rF
-uuJXks6hxrmJ5hh5D6FXdlQjTCdG3u9w0+KD4n1BkBkEaqflAkEA9q4TBt1bLOvV
-bbwz7bunI6bwS5eD7sVn1qUqrm6hcirhF1xCv75pO/uqAyccbguxjp8y2LNuN+cO
-IgSwr+Jq1wJBAOBFuKSMAcg2WmJ4IAT7143yhoHKMgA8Nl4sfLFwFl2/hw+fdEBe
-gndRfKHT4IV/YLcnS7d/H6mEMSAusWx5QPcCQQDTYaF+TWrW2JRAf3jEK/xyiZf6
-PrDYh6KOhWRIqxZ/fYz69p1gL6t/sg0ivH4ZMr4JKBRrK360OrOapQg+/7drAkB6
-3pfPRok/aE/SfN+F+3fX49Q/TUhhipt6ssLJ74/BYsobDBADqAOwXSt7+XmbifKx
-xUydRn9RPwQvDoXT2QZ3AkAdnwR9PMEHAsaibrPyzBztKjPL2rWBRk1QAmcdrTpt
-XL99XfmkERWtiBA/Lz2K332qYOa/zo5c/SADx9fm7+HP
------END RSA PRIVATE KEY-----
diff --git a/test/session.js b/test/session.js
index 6862ccc4..405e3ddf 100644
--- a/test/session.js
+++ b/test/session.js
@@ -2,13 +2,16 @@
var after = require('after')
var assert = require('assert')
var cookieParser = require('cookie-parser')
+var crypto = require('crypto')
var express = require('express')
var fs = require('fs')
var http = require('http')
var https = require('https')
var request = require('supertest')
var session = require('../')
-var util = require('util')
+var SmartStore = require('./support/smart-store')
+var SyncStore = require('./support/sync-store')
+var utils = require('./support/utils')
var Cookie = require('../session/cookie')
@@ -288,34 +291,21 @@ describe('session()', function(){
describe('when response ended', function () {
it('should have saved session', function (done) {
- var saved = false
var store = new session.MemoryStore()
var server = createServer({ store: store }, function (req, res) {
req.session.hit = true
res.end('session saved')
})
- var _set = store.set
- store.set = function set(sid, sess, callback) {
- setTimeout(function () {
- _set.call(store, sid, sess, function (err) {
- saved = true
- callback(err)
- })
- }, 200)
- }
-
request(server)
- .get('/')
- .expect(200, 'session saved', function (err) {
- if (err) return done(err)
- assert.ok(saved)
- done()
- })
+ .get('/')
+ .expect(200)
+ .expect(shouldSetSessionInStore(store, 200))
+ .expect('session saved')
+ .end(done)
})
it('should have saved session even with empty response', function (done) {
- var saved = false
var store = new session.MemoryStore()
var server = createServer({ store: store }, function (req, res) {
req.session.hit = true
@@ -323,27 +313,14 @@ describe('session()', function(){
res.end()
})
- var _set = store.set
- store.set = function set(sid, sess, callback) {
- setTimeout(function () {
- _set.call(store, sid, sess, function (err) {
- saved = true
- callback(err)
- })
- }, 200)
- }
-
request(server)
- .get('/')
- .expect(200, '', function (err) {
- if (err) return done(err)
- assert.ok(saved)
- done()
- })
+ .get('/')
+ .expect(200)
+ .expect(shouldSetSessionInStore(store, 200))
+ .end(done)
})
it('should have saved session even with multi-write', function (done) {
- var saved = false
var store = new session.MemoryStore()
var server = createServer({ store: store }, function (req, res) {
req.session.hit = true
@@ -352,27 +329,15 @@ describe('session()', function(){
res.end('world')
})
- var _set = store.set
- store.set = function set(sid, sess, callback) {
- setTimeout(function () {
- _set.call(store, sid, sess, function (err) {
- saved = true
- callback(err)
- })
- }, 200)
- }
-
request(server)
- .get('/')
- .expect(200, 'hello, world', function (err) {
- if (err) return done(err)
- assert.ok(saved)
- done()
- })
+ .get('/')
+ .expect(200)
+ .expect(shouldSetSessionInStore(store, 200))
+ .expect('hello, world')
+ .end(done)
})
it('should have saved session even with non-chunked response', function (done) {
- var saved = false
var store = new session.MemoryStore()
var server = createServer({ store: store }, function (req, res) {
req.session.hit = true
@@ -380,23 +345,12 @@ describe('session()', function(){
res.end('session saved')
})
- var _set = store.set
- store.set = function set(sid, sess, callback) {
- setTimeout(function () {
- _set.call(store, sid, sess, function (err) {
- saved = true
- callback(err)
- })
- }, 200)
- }
-
request(server)
- .get('/')
- .expect(200, 'session saved', function (err) {
- if (err) return done(err)
- assert.ok(saved)
- done()
- })
+ .get('/')
+ .expect(200)
+ .expect(shouldSetSessionInStore(store, 200))
+ .expect('session saved')
+ .end(done)
})
it('should have saved session with updated cookie expiration', function (done) {
@@ -480,7 +434,7 @@ describe('session()', function(){
.get('/')
.set('Cookie', cookie(res))
.expect(shouldSetCookie('connect.sid'))
- .expect(shouldSetCookieToDifferentSessionId(res))
+ .expect(shouldSetCookieToDifferentSessionId(sid(res)))
.expect(200, 'session 2', done)
})
})
@@ -609,6 +563,31 @@ describe('session()', function(){
})
})
+ describe('when session without cookie property in store', function () {
+ it('should pass error from inflate', function (done) {
+ var count = 0
+ var store = new session.MemoryStore()
+ var server = createServer({ store: store }, function (req, res) {
+ req.session.num = req.session.num || ++count
+ res.end('session ' + req.session.num)
+ })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, 'session 1', function (err, res) {
+ if (err) return done(err)
+ store.set(sid(res), { foo: 'bar' }, function (err) {
+ if (err) return done(err)
+ request(server)
+ .get('/')
+ .set('Cookie', cookie(res))
+ .expect(500, /Cannot read prop/, done)
+ })
+ })
+ })
+ })
+
describe('proxy option', function(){
describe('when enabled', function(){
var server
@@ -644,8 +623,8 @@ describe('session()', function(){
before(function () {
function setup (req) {
req.secure = req.headers['x-secure']
- ? JSON.parse(req.headers['x-secure'])
- : undefined
+ ? JSON.parse(req.headers['x-secure'])
+ : undefined
}
function respond (req, res) {
@@ -677,8 +656,8 @@ describe('session()', function(){
before(function () {
function setup (req) {
req.secure = req.headers['x-secure']
- ? JSON.parse(req.headers['x-secure'])
- : undefined
+ ? JSON.parse(req.headers['x-secure'])
+ : undefined
}
function respond (req, res) {
@@ -821,6 +800,286 @@ describe('session()', function(){
.expect(200, 'false', done)
})
})
+
+ describe('when request socket is encrypted', function () {
+ it('should set secure over TLS', function (done) {
+ var cert = fs.readFileSync(__dirname + '/fixtures/server.crt', 'ascii')
+ var server = https.createServer({
+ key: fs.readFileSync(__dirname + '/fixtures/server.key', 'ascii'),
+ cert: cert
+ })
+
+ server.on('request', createRequestListener({ secret: 'keyboard cat', cookie: { secure: 'auto' } }))
+
+ var agent = new https.Agent({ ca: cert })
+ var createConnection = agent.createConnection
+
+ agent.createConnection = function (options) {
+ options.servername = 'express-session.local'
+ return createConnection.call(this, options)
+ }
+
+ var req = request(server).get('/')
+ req.agent(agent)
+ req.expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+ req.expect(200, done)
+ })
+ })
+ })
+
+ describe('when "cookie" is a function', function () {
+ it('should call custom function and apply cookie options', function (done) {
+ var cookieCallbackCalled = false;
+ var cookieCallback = function () {
+ cookieCallbackCalled = true;
+ return { path: '/test', httpOnly: true, secure: false };
+ };
+ var server = createServer({ cookie: cookieCallback });
+ request(server)
+ .get('/test')
+ .expect(
+ shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/test')
+ )
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly'))
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+ .expect(200, function (err) {
+ if (err) return done(err);
+ assert.strictEqual(
+ cookieCallbackCalled,
+ true,
+ 'should have called cookie callback'
+ );
+ done();
+ });
+ });
+
+ it('should provide req argument', function (done) {
+ var _path = '/test';
+ var cookieCallbackCalled = false;
+ var cookieCallback = function (req) {
+ cookieCallbackCalled = true;
+ return { path: req.url, httpOnly: true, secure: false };
+ };
+ var server = createServer({ cookie: cookieCallback });
+ request(server)
+ .get(_path)
+ .expect(
+ shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', _path)
+ )
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly'))
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+ .expect(200, function (err) {
+ if (err) return done(err);
+ assert.strictEqual(
+ cookieCallbackCalled,
+ true,
+ 'should have called cookie callback'
+ );
+ done();
+ });
+ });
+
+ it('should not set cookie when request-path does not match returned path', function (done) {
+ var cookieCallback = function () {
+ return { path: '/admin', httpOnly: true, secure: false };
+ };
+ var server = createServer({ cookie: cookieCallback });
+ request(server)
+ .get('/administrator')
+ .expect(shouldNotHaveHeader('Set-Cookie'))
+ .expect(200, done);
+ });
+
+ it('should resolve "secure" and "sameSite" set to "auto"', function (done) {
+ function setup (req) {
+ req.secure = JSON.parse(req.headers['x-secure'])
+ }
+
+ function respond (req, res) {
+ res.end(String(req.secure))
+ }
+
+ var cookieCallback = function () {
+ return { path: '/', secure: 'auto', sameSite: 'auto' };
+ };
+ var server = createServer(setup, { cookie: cookieCallback }, respond);
+ request(server)
+ .get('/')
+ .set('X-Secure', 'true')
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+ .expect(
+ shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')
+ )
+ .expect(200, 'true', done);
+ });
+ });
+
+
+ describe('when "sameSite" set to "auto"', function () {
+ describe('basic functionality', function () {
+ before(function () {
+ function setup (req) {
+ req.secure = JSON.parse(req.headers['x-secure'])
+ }
+
+ function respond (req, res) {
+ res.end(String(req.secure))
+ }
+
+ this.server = createServer(setup, { cookie: { sameSite: 'auto' } }, respond)
+ })
+
+ it('should set SameSite=None for secure connections', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'true')
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+ .expect(200, 'true', done)
+ })
+
+ it('should set SameSite=Lax for insecure connections', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'false')
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+ .expect(200, 'false', done)
+ })
+ })
+
+ describe('with proxy settings', function () {
+ describe('when "proxy" is "true"', function () {
+ before(function () {
+ this.server = createServer({ proxy: true, cookie: { sameSite: 'auto' }})
+ })
+
+ it('should set SameSite=None when X-Forwarded-Proto is https', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Forwarded-Proto', 'https')
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+ .expect(200, done)
+ })
+
+ it('should set SameSite=Lax when X-Forwarded-Proto is http', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Forwarded-Proto', 'http')
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+ .expect(200, done)
+ })
+ })
+
+ describe('when "proxy" is "false"', function () {
+ before(function () {
+ this.server = createServer({ proxy: false, cookie: { sameSite: 'auto' }})
+ })
+
+ it('should set SameSite=Lax when X-Forwarded-Proto is https', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Forwarded-Proto', 'https')
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+ .expect(200, done)
+ })
+ })
+ })
+
+ describe('combined with secure auto', function() {
+ describe('when "secure" is "auto"', function () {
+ before(function () {
+ function setup (req) {
+ req.secure = JSON.parse(req.headers['x-secure'])
+ }
+
+ function respond (req, res) {
+ res.end(String(req.secure))
+ }
+
+ this.server = createServer(setup, { cookie: { secure: 'auto', sameSite: 'auto' } }, respond)
+ })
+
+ it('should set both Secure and SameSite=None when secure', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'true')
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+ .expect(200, 'true', done)
+ })
+
+ it('should set neither Secure nor SameSite=None when insecure', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'false')
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+ .expect(200, 'false', done)
+ })
+ })
+
+ describe('when "secure" is "false"', function () {
+ before(function () {
+ function setup (req) {
+ req.secure = JSON.parse(req.headers['x-secure'])
+ }
+
+ function respond (req, res) {
+ res.end(String(req.secure))
+ }
+
+ this.server = createServer(setup, { cookie: { secure: false, sameSite: 'auto' } }, respond)
+ })
+
+ it('should set SameSite=None without Secure when secure', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'true')
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+ .expect(200, 'true', done)
+ })
+
+ it('should set SameSite=Lax without Secure when insecure', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'false')
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+ .expect(200, 'false', done)
+ })
+ })
+
+ describe('when "secure" is "true"', function () {
+ before(function () {
+ function setup (req) {
+ req.secure = JSON.parse(req.headers['x-secure'])
+ }
+
+ function respond (req, res) {
+ res.end(String(req.secure))
+ }
+
+ this.server = createServer(setup, { cookie: { secure: true, sameSite: 'auto' } }, respond)
+ })
+
+ it('should set both Secure and SameSite=None when secure', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'true')
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+ .expect(200, 'true', done)
+ })
+
+ it('should not set cookie when insecure', function (done) {
+ request(this.server)
+ .get('/')
+ .set('X-Secure', 'false')
+ .expect(shouldNotHaveHeader('Set-Cookie'))
+ .expect(200, 'false', done)
+ })
+ })
+ })
})
})
@@ -1040,7 +1299,7 @@ describe('session()', function(){
var store = new session.MemoryStore()
var server = createServer({ resave: false, store: store }, function (req, res) {
if (req.method === 'PUT') {
- req.session.token = req.url.substr(1)
+ req.session.token = req.url.slice(1)
}
res.end('token=' + (req.session.token || ''))
})
@@ -1219,6 +1478,50 @@ describe('session()', function(){
assert.throws(createServer.bind(null, { secret: [] }), /secret option array/);
})
+ it('should sign and unsign with a string', function (done) {
+ var server = createServer({ secret: 'awesome cat' }, function (req, res) {
+ if (!req.session.user) {
+ req.session.user = 'bob'
+ res.end('set')
+ } else {
+ res.end('get:' + JSON.stringify(req.session.user))
+ }
+ })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, 'set', function (err, res) {
+ if (err) return done(err)
+ request(server)
+ .get('/')
+ .set('Cookie', cookie(res))
+ .expect(200, 'get:"bob"', done)
+ })
+ })
+
+ it('should sign and unsign with a Buffer', function (done) {
+ var server = createServer({ secret: crypto.randomBytes(32) }, function (req, res) {
+ if (!req.session.user) {
+ req.session.user = 'bob'
+ res.end('set')
+ } else {
+ res.end('get:' + JSON.stringify(req.session.user))
+ }
+ })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, 'set', function (err, res) {
+ if (err) return done(err)
+ request(server)
+ .get('/')
+ .set('Cookie', cookie(res))
+ .expect(200, 'get:"bob"', done)
+ })
+ })
+
describe('when an array', function () {
it('should sign cookies', function (done) {
var server = createServer({ secret: ['keyboard cat', 'nyan cat'] }, function (req, res) {
@@ -1396,7 +1699,7 @@ describe('session()', function(){
describe('res.end patch', function () {
it('should correctly handle res.end/res.write patched prior', function (done) {
function setup (req, res) {
- writePatch(res)
+ utils.writePatch(res)
}
function respond (req, res) {
@@ -1412,7 +1715,7 @@ describe('session()', function(){
it('should correctly handle res.end/res.write patched after', function (done) {
function respond (req, res) {
- writePatch(res)
+ utils.writePatch(res)
req.session.hit = true
res.write('hello, ')
res.end('world')
@@ -1422,6 +1725,42 @@ describe('session()', function(){
.get('/')
.expect(200, 'hello, world', done)
})
+
+ it('should error when res.end is called twice', function (done) {
+ var error1 = null
+ var error2 = null
+ var server = http.createServer(function (req, res) {
+ res.end()
+
+ try {
+ res.setHeader('Content-Length', '3')
+ res.end('foo')
+ } catch (e) {
+ error1 = e
+ }
+ })
+
+ function respond (req, res) {
+ res.end()
+
+ try {
+ res.setHeader('Content-Length', '3')
+ res.end('foo')
+ } catch (e) {
+ error2 = e
+ }
+ }
+
+ request(server)
+ .get('/')
+ .end(function (err, res) {
+ if (err) return done(err)
+ request(createServer(null, respond))
+ .get('/')
+ .expect(function () { assert.strictEqual((error1 && error1.message), (error2 && error2.message)) })
+ .expect(res.statusCode, res.text, done)
+ })
+ })
})
describe('req.session', function(){
@@ -1650,6 +1989,49 @@ describe('session()', function(){
.expect(500, 'failed to load session', done)
})
})
+
+ it('should not override an overridden `reload` in case of errors', function (done) {
+ var store = new session.MemoryStore()
+ var server = createServer({ store: store, resave: false }, function (req, res) {
+ if (req.url === '/') {
+ req.session.active = true
+ res.end('session created')
+ return
+ }
+
+ store.clear(function (err) {
+ if (err) return done(err)
+
+ // reload way too many times on top of each other,
+ // attempting to overflow the call stack
+ var iters = 20
+ reload()
+ function reload () {
+ if (!--iters) {
+ res.end('ok')
+ return
+ }
+
+ try {
+ req.session.reload(reload)
+ } catch (e) {
+ res.statusCode = 500
+ res.end(e.message)
+ }
+ }
+ })
+ })
+
+ request(server)
+ .get('/')
+ .expect(200, 'session created', function (err, res) {
+ if (err) return done(err)
+ request(server)
+ .get('/foo')
+ .set('Cookie', cookie(res))
+ .expect(200, 'ok', done)
+ })
+ })
})
describe('.save()', function () {
@@ -1718,6 +2100,31 @@ describe('session()', function(){
.expect(200, 'saved', done)
})
})
+
+ describe('when saveUninitialized is false', function () {
+ it('should prevent end-of-request save', function (done) {
+ var store = new session.MemoryStore()
+ var server = createServer({ saveUninitialized: false, store: store }, function (req, res) {
+ req.session.hit = true
+ req.session.save(function (err) {
+ if (err) return res.end(err.message)
+ res.end('saved')
+ })
+ })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetSessionInStore(store))
+ .expect(200, 'saved', function (err, res) {
+ if (err) return done(err)
+ request(server)
+ .get('/')
+ .set('Cookie', cookie(res))
+ .expect(shouldSetSessionInStore(store))
+ .expect(200, 'saved', done)
+ })
+ })
+ })
})
describe('.touch()', function () {
@@ -1796,18 +2203,43 @@ describe('session()', function(){
})
it('should override defaults', function(done){
- var server = createServer({ cookie: { path: '/admin', httpOnly: false, secure: true, maxAge: 5000 } }, function (req, res) {
+ var opts = {
+ httpOnly: false,
+ maxAge: 5000,
+ path: '/admin',
+ priority: 'high',
+ secure: true
+ }
+ var server = createServer({ cookie: opts }, function (req, res) {
req.session.cookie.secure = false
res.end()
})
request(server)
- .get('/admin')
- .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
- .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
- .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
- .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
- .expect(200, done)
+ .get('/admin')
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+ .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Priority', 'High'))
+ .expect(200, done)
+ })
+
+ it('should forward errors setting cookie', function (done) {
+ var cb = after(2, done)
+ var server = createServer({ cookie: { expires: new Date(NaN) } }, function (req, res) {
+ res.end()
+ })
+
+ server.on('error', function onerror (err) {
+ assert.ok(err)
+ assert.strictEqual(err.message, 'option expires is invalid')
+ cb()
+ })
+
+ request(server)
+ .get('/admin')
+ .expect(200, cb)
})
it('should preserve cookies set before writeHead is called', function(done){
@@ -1822,6 +2254,100 @@ describe('session()', function(){
.expect(shouldSetCookieToValue('previous', 'cookieValue'))
.expect(200, done)
})
+
+ it('should preserve cookies set in writeHead', function (done) {
+ var server = createServer(null, function (req, res) {
+ var cookie = new Cookie()
+ res.writeHead(200, {
+ 'Set-Cookie': cookie.serialize('previous', 'cookieValue')
+ })
+ res.end()
+ })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookieToValue('previous', 'cookieValue'))
+ .expect(200, done)
+ })
+ })
+
+ describe('.originalMaxAge', function () {
+ it('should equal original maxAge', function (done) {
+ var server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+ res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+ })
+
+ request(server)
+ .get('/')
+ .expect(200)
+ .expect(function (res) {
+ // account for 1ms latency
+ assert.ok(res.text === '2000' || res.text === '1999',
+ 'expected 2000, got ' + res.text)
+ })
+ .end(done)
+ })
+
+ it('should equal original maxAge for all requests', function (done) {
+ var server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+ res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+ })
+
+ request(server)
+ .get('/')
+ .expect(200)
+ .expect(function (res) {
+ // account for 1ms latency
+ assert.ok(res.text === '2000' || res.text === '1999',
+ 'expected 2000, got ' + res.text)
+ })
+ .end(function (err, res) {
+ if (err) return done(err)
+ setTimeout(function () {
+ request(server)
+ .get('/')
+ .set('Cookie', cookie(res))
+ .expect(200)
+ .expect(function (res) {
+ // account for 1ms latency
+ assert.ok(res.text === '2000' || res.text === '1999',
+ 'expected 2000, got ' + res.text)
+ })
+ .end(done)
+ }, 100)
+ })
+ })
+
+ it('should equal original maxAge for all requests', function (done) {
+ var store = new SmartStore()
+ var server = createServer({ cookie: { maxAge: 2000 }, store: store }, function (req, res) {
+ res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+ })
+
+ request(server)
+ .get('/')
+ .expect(200)
+ .expect(function (res) {
+ // account for 1ms latency
+ assert.ok(res.text === '2000' || res.text === '1999',
+ 'expected 2000, got ' + res.text)
+ })
+ .end(function (err, res) {
+ if (err) return done(err)
+ setTimeout(function () {
+ request(server)
+ .get('/')
+ .set('Cookie', cookie(res))
+ .expect(200)
+ .expect(function (res) {
+ // account for 1ms latency
+ assert.ok(res.text === '2000' || res.text === '1999',
+ 'expected 2000, got ' + res.text)
+ })
+ .end(done)
+ }, 100)
+ })
+ })
})
describe('.secure', function(){
@@ -1987,6 +2513,41 @@ describe('session()', function(){
})
})
})
+
+ describe('.partitioned', function () {
+ describe('by default', function () {
+ it('should not set partitioned attribute', function (done) {
+ var server = createServer()
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Partitioned'))
+ .expect(200, done)
+ })
+ })
+
+ describe('when "false"', function () {
+ it('should not set partitioned attribute', function (done) {
+ var server = createServer({ cookie: { partitioned: false } })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Partitioned'))
+ .expect(200, done)
+ })
+ })
+
+ describe('when "true"', function () {
+ it('should set partitioned attribute', function (done) {
+ var server = createServer({ cookie: { partitioned: true } })
+
+ request(server)
+ .get('/')
+ .expect(shouldSetCookieWithAttribute('connect.sid', 'Partitioned'))
+ .expect(200, done)
+ })
+ })
+ })
})
})
@@ -2120,6 +2681,115 @@ describe('session()', function(){
})
})
+describe('path matching (RFC 6265)', function () {
+ describe('when "path" is "/" (root path)', function () {
+ before(function () {
+ this.server = createServer({ cookie: { path: '/' } })
+ })
+
+ it('should set cookie when request-path is "/" (root path)', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path and the request-path are identical."
+ request(this.server)
+ .get('/')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+
+ it('should set cookie when request-path is any path ("/foo")', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+ // character of the cookie-path is %x2F ("/")."
+ request(this.server)
+ .get('/foo')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+
+ it('should set cookie when request-path has multiple segments ("/foo/bar/baz")', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+ // character of the cookie-path is %x2F ("/")."
+ request(this.server)
+ .get('/foo/bar/baz')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+ })
+
+ describe('when "path" is "/admin"', function () {
+ before(function () {
+ this.server = createServer({ cookie: { path: '/admin' } })
+ })
+
+ it('should set cookie when request-path and cookie-path are identical ("/admin")', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path and the request-path are identical."
+ request(this.server)
+ .get('/admin')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+
+ it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/")', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+ // character of the cookie-path is %x2F ("/")."
+ request(this.server)
+ .get('/admin/')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+
+ it('should set cookie when cookie-path is prefix and next char is "/" ("/admin/users")', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the first
+ // character of the request-path that is not included in the cookie-path is a %x2F ("/") character."
+ request(this.server)
+ .get('/admin/users')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+
+ it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) {
+ // RFC 6265 5.1.4: None of the path-match conditions are met
+ request(this.server)
+ .get('/administrator')
+ .expect(shouldNotHaveHeader('Set-Cookie'))
+ .expect(200, done)
+ })
+ })
+
+ describe('when "path" is "/admin/" (trailing slash)', function () {
+ before(function () {
+ this.server = createServer({ cookie: { path: '/admin/' } })
+ })
+
+ it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/x")', function (done) {
+ // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+ // character of the cookie-path is %x2F ("/")."
+ request(this.server)
+ .get('/admin/x')
+ .expect(shouldSetCookie('connect.sid'))
+ .expect(200, done)
+ })
+
+ it('should NOT set cookie when request-path is not prefixed by cookie-path ("/admin")', function (done) {
+ // RFC 6265 5.1.4: cookie-path "/admin/" is not a prefix of request-path "/admin"
+ request(this.server)
+ .get('/admin')
+ .expect(shouldNotHaveHeader('Set-Cookie'))
+ .expect(200, done)
+ })
+
+ it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) {
+ // RFC 6265 5.1.4: None of the path-match conditions are met:
+ // 1. The paths are not identical
+ // 2. "/admin/" is not a prefix of "/administrator"
+ // 3. The prefix condition with next character "/" is not applicable
+ request(this.server)
+ .get('/administrator')
+ .expect(shouldNotHaveHeader('Set-Cookie'))
+ .expect(200, done)
+ })
+ })
+})
+
+
function cookie(res) {
var setCookie = res.headers['set-cookie'];
return (setCookie && setCookie[0]) || undefined;
@@ -2185,7 +2855,7 @@ function end(req, res) {
function expires (res) {
var header = cookie(res)
- return header && parseSetCookie(header).expires
+ return header && utils.parseSetCookie(header).expires
}
function mountAt (path) {
@@ -2197,25 +2867,6 @@ function mountAt (path) {
}
}
-function parseSetCookie (header) {
- var match
- var pairs = []
- var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
-
- while ((match = pattern.exec(header))) {
- pairs.push({ name: match[1], value: match[2] })
- }
-
- var cookie = pairs.shift()
-
- for (var i = 0; i < pairs.length; i++) {
- match = pairs[i]
- cookie[match.name.toLowerCase()] = (match.value || true)
- }
-
- return cookie
-}
-
function shouldNotHaveHeader(header) {
return function (res) {
assert.ok(!(header.toLowerCase() in res.headers), 'should not have ' + header + ' header')
@@ -2239,7 +2890,7 @@ function shouldNotSetSessionInStore(store) {
function shouldSetCookie (name) {
return function (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
assert.ok(header, 'should have a cookie header')
assert.strictEqual(data.name, name, 'should set cookie ' + name)
}
@@ -2254,7 +2905,7 @@ function shouldSetCookieToDifferentSessionId (id) {
function shouldSetCookieToExpireIn (name, delta) {
return function (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
assert.ok(header, 'should have a cookie header')
assert.strictEqual(data.name, name, 'should set cookie ' + name)
assert.ok(('expires' in data), 'should set cookie with attribute Expires')
@@ -2266,7 +2917,7 @@ function shouldSetCookieToExpireIn (name, delta) {
function shouldSetCookieToValue (name, val) {
return function (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
assert.ok(header, 'should have a cookie header')
assert.strictEqual(data.name, name, 'should set cookie ' + name)
assert.strictEqual(data.value, val, 'should set cookie ' + name + ' to ' + val)
@@ -2276,7 +2927,7 @@ function shouldSetCookieToValue (name, val) {
function shouldSetCookieWithAttribute (name, attrib) {
return function (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
assert.ok(header, 'should have a cookie header')
assert.strictEqual(data.name, name, 'should set cookie ' + name)
assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
@@ -2286,7 +2937,7 @@ function shouldSetCookieWithAttribute (name, attrib) {
function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
return function (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
assert.ok(header, 'should have a cookie header')
assert.strictEqual(data.name, name, 'should set cookie ' + name)
assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
@@ -2297,20 +2948,32 @@ function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
function shouldSetCookieWithoutAttribute (name, attrib) {
return function (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
assert.ok(header, 'should have a cookie header')
assert.strictEqual(data.name, name, 'should set cookie ' + name)
assert.ok(!(attrib.toLowerCase() in data), 'should set cookie without attribute ' + attrib)
}
}
-function shouldSetSessionInStore(store) {
+function shouldSetSessionInStore (store, delay) {
var _set = store.set
var count = 0
store.set = function set () {
count++
- return _set.apply(this, arguments)
+
+ if (!delay) {
+ return _set.apply(this, arguments)
+ }
+
+ var args = new Array(arguments.length + 1)
+
+ args[0] = this
+ for (var i = 1; i < args.length; i++) {
+ args[i] = arguments[i - 1]
+ }
+
+ setTimeout(_set.bind.apply(_set, args), delay)
}
return function () {
@@ -2320,48 +2983,8 @@ function shouldSetSessionInStore(store) {
function sid (res) {
var header = cookie(res)
- var data = header && parseSetCookie(header)
+ var data = header && utils.parseSetCookie(header)
var value = data && unescape(data.value)
var sid = value && value.substring(2, value.indexOf('.'))
return sid || undefined
}
-
-function writePatch (res) {
- var _end = res.end
- var _write = res.write
- var ended = false
-
- res.end = function end() {
- ended = true
- return _end.apply(this, arguments)
- }
-
- res.write = function write() {
- if (ended) {
- throw new Error('write after end')
- }
-
- return _write.apply(this, arguments)
- }
-}
-
-function SyncStore () {
- session.Store.call(this)
- this.sessions = Object.create(null)
-}
-
-util.inherits(SyncStore, session.Store)
-
-SyncStore.prototype.destroy = function destroy(sid, callback) {
- delete this.sessions[sid];
- callback();
-};
-
-SyncStore.prototype.get = function get(sid, callback) {
- callback(null, JSON.parse(this.sessions[sid]));
-};
-
-SyncStore.prototype.set = function set(sid, sess, callback) {
- this.sessions[sid] = JSON.stringify(sess);
- callback();
-};
diff --git a/test/support/gencert.sh b/test/support/gencert.sh
new file mode 100755
index 00000000..cfdda070
--- /dev/null
+++ b/test/support/gencert.sh
@@ -0,0 +1,5 @@
+#! /bin/sh
+set -ex
+
+openssl req -x509 -nodes -newkey rsa:2048 -keyout ./test/fixtures/server.key -out ./test/fixtures/server.crt -days 3650 \
+-subj "/C=US/ST=Illinois/L=Chicago/O=node-express-session/CN=express-session.local"
diff --git a/test/support/smart-store.js b/test/support/smart-store.js
new file mode 100644
index 00000000..8b224fdd
--- /dev/null
+++ b/test/support/smart-store.js
@@ -0,0 +1,54 @@
+'use strict'
+
+var session = require('../../')
+var util = require('util')
+
+/* istanbul ignore next */
+var defer = typeof setImmediate === 'function'
+ ? setImmediate
+ : function(fn){ process.nextTick(fn.bind.apply(fn, arguments)) }
+
+module.exports = SmartStore
+
+function SmartStore () {
+ session.Store.call(this)
+ this.sessions = Object.create(null)
+}
+
+util.inherits(SmartStore, session.Store)
+
+SmartStore.prototype.destroy = function destroy (sid, callback) {
+ delete this.sessions[sid]
+ defer(callback, null)
+}
+
+SmartStore.prototype.get = function get (sid, callback) {
+ var sess = this.sessions[sid]
+
+ if (!sess) {
+ return
+ }
+
+ // parse
+ sess = JSON.parse(sess)
+
+ if (sess.cookie) {
+ // expand expires into Date object
+ sess.cookie.expires = typeof sess.cookie.expires === 'string'
+ ? new Date(sess.cookie.expires)
+ : sess.cookie.expires
+
+ // destroy expired session
+ if (sess.cookie.expires && sess.cookie.expires <= Date.now()) {
+ delete this.sessions[sid]
+ sess = null
+ }
+ }
+
+ defer(callback, null, sess)
+}
+
+SmartStore.prototype.set = function set (sid, sess, callback) {
+ this.sessions[sid] = JSON.stringify(sess)
+ defer(callback, null)
+}
diff --git a/test/support/sync-store.js b/test/support/sync-store.js
new file mode 100644
index 00000000..b45dc9a8
--- /dev/null
+++ b/test/support/sync-store.js
@@ -0,0 +1,27 @@
+'use strict'
+
+var session = require('../../')
+var util = require('util')
+
+module.exports = SyncStore
+
+function SyncStore () {
+ session.Store.call(this)
+ this.sessions = Object.create(null)
+}
+
+util.inherits(SyncStore, session.Store)
+
+SyncStore.prototype.destroy = function destroy (sid, callback) {
+ delete this.sessions[sid]
+ callback()
+}
+
+SyncStore.prototype.get = function get (sid, callback) {
+ callback(null, JSON.parse(this.sessions[sid]))
+}
+
+SyncStore.prototype.set = function set (sid, sess, callback) {
+ this.sessions[sid] = JSON.stringify(sess)
+ callback()
+}
diff --git a/test/support/utils.js b/test/support/utils.js
new file mode 100644
index 00000000..0f13ba6a
--- /dev/null
+++ b/test/support/utils.js
@@ -0,0 +1,42 @@
+'use strict'
+
+module.exports.parseSetCookie = parseSetCookie
+module.exports.writePatch = writePatch
+
+function parseSetCookie (header) {
+ var match
+ var pairs = []
+ var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
+
+ while ((match = pattern.exec(header))) {
+ pairs.push({ name: match[1], value: match[2] })
+ }
+
+ var cookie = pairs.shift()
+
+ for (var i = 0; i < pairs.length; i++) {
+ match = pairs[i]
+ cookie[match.name.toLowerCase()] = (match.value || true)
+ }
+
+ return cookie
+}
+
+function writePatch (res) {
+ var _end = res.end
+ var _write = res.write
+ var ended = false
+
+ res.end = function end () {
+ ended = true
+ return _end.apply(this, arguments)
+ }
+
+ res.write = function write () {
+ if (ended) {
+ throw new Error('write after end')
+ }
+
+ return _write.apply(this, arguments)
+ }
+}