From dd5a3528dc3ec9af6bfa91865d38439d4f35223f Mon Sep 17 00:00:00 2001
From: Mike Bissett <mike@burstsms.com>
Date: Thu, 20 Nov 2014 03:39:49 +0000
Subject: [PATCH] Make secret and signing of cookies optional

---
 README.md |  3 +++
 index.js  | 65 +++++++++++++++++++++++++++++++++----------------------
 2 files changed, 42 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index 5e889faa..871c60c9 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,6 @@
+Fork of expressjs/session that allows you to not sign the cookie, allowing the use of 
+php sessions. (PHP doesnt seem to allow you to change its session cookie to sign it)
+
 # express-session
 
 [![NPM Version][npm-image]][npm-url]
diff --git a/index.js b/index.js
index eaf7036c..1c08c4cd 100644
--- a/index.js
+++ b/index.js
@@ -132,9 +132,9 @@ function session(options){
   store.on('disconnect', function(){ storeReady = false; });
   store.on('connect', function(){ storeReady = true; });
 
-  if (!options.secret) {
+  /*if (!options.secret) {
     deprecate('req.secret; provide secret option');
-  }
+  }*/
 
   return function session(req, res, next) {
     // self-awareness
@@ -150,10 +150,10 @@ function session(options){
 
     // backwards compatibility for signed cookies
     // req.secret is passed from the cookie parser middleware
-    var secret = options.secret || req.secret;
+    var secret = options.secret || req.secret || null;
 
     // ensure secret is available or bail
-    if (!secret) next(new Error('`secret` option required for sessions'));
+//    if (!secret) next(new Error('`secret` option required for sessions'));
 
     var originalHash;
     var originalId;
@@ -417,15 +417,19 @@ function getcookie(req, name, secret) {
     raw = cookies[name];
 
     if (raw) {
-      if (raw.substr(0, 2) === 's:') {
-        val = signature.unsign(raw.slice(2), secret);
-
-        if (val === false) {
-          debug('cookie signature invalid');
-          val = undefined;
-        }
+      if ( !secret ) { 
+          val = raw
       } else {
-        debug('cookie unsigned')
+          if (raw.substr(0, 2) === 's:') {
+            val = signature.unsign(raw.slice(2), secret);
+
+            if (val === false) {
+              debug('cookie signature invalid');
+              val = undefined;
+            }
+          } else {
+            debug('cookie unsigned')
+          }
       }
     }
   }
@@ -444,19 +448,23 @@ function getcookie(req, name, secret) {
     raw = req.cookies[name];
 
     if (raw) {
-      if (raw.substr(0, 2) === 's:') {
-        val = signature.unsign(raw.slice(2), secret);
-
-        if (val) {
-          deprecate('cookie should be available in req.headers.cookie');
-        }
-
-        if (val === false) {
-          debug('cookie signature invalid');
-          val = undefined;
-        }
+      if ( !secret ) {
+          val = raw
       } else {
-        debug('cookie unsigned')
+          if (raw.substr(0, 2) === 's:') {
+            val = signature.unsign(raw.slice(2), secret);
+
+            if (val) {
+              deprecate('cookie should be available in req.headers.cookie');
+            }
+
+            if (val === false) {
+              debug('cookie signature invalid');
+              val = undefined;
+            }
+          } else {
+            debug('cookie unsigned')
+          }
       }
     }
   }
@@ -525,8 +533,13 @@ function issecure(req, trustProxy) {
  */
 
 function setcookie(res, name, val, secret, options) {
-  var signed = 's:' + signature.sign(val, secret);
-  var data = cookie.serialize(name, signed, options);
+  var data
+  if ( !secret ) {
+    data = cookie.serialize(name, val, options);
+  } else {
+    var signed = 's:' + signature.sign(val, secret);
+    data = cookie.serialize(name, signed, options);
+  }
 
   debug('set-cookie %s', data);