From 83fc9c94fb50599716d21700578d4cdbbf8eb33b Mon Sep 17 00:00:00 2001 From: nashibao Date: Wed, 28 Dec 2016 16:21:00 +0900 Subject: [PATCH 1/6] add useAuthorizationBearerToken option --- index.js | 46 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 14 deletions(-) diff --git a/index.js b/index.js index 01752a12..efeaf0fa 100644 --- a/index.js +++ b/index.js @@ -156,6 +156,7 @@ function session(options) { // generates the new session store.generate = function(req){ req.sessionID = generateId(req); + req.sessionSignedID = 's:' + signature.sign(req.sessionID, secret[0]) req.session = new Session(req); req.session.cookie = new Cookie(cookieOptions); @@ -502,6 +503,15 @@ function generateSessionId(sess) { return uid(24); } +function getCookieByAuthorizationBearerToken(req) { + var token = req.get('Authorization'); + if (!token) { + return null; + } + token = token.replace(/Bearer:\s*/, '').replace(/\s*/, '') + return token; +} + /** * Get the session ID cookie from request. * @@ -510,27 +520,35 @@ function generateSessionId(sess) { */ function getcookie(req, name, secrets) { - var header = req.headers.cookie; + var raw; var val; - // read from cookie header - if (header) { - var cookies = cookie.parse(header); + if (req.useAuthorizationBearerToken) { - raw = cookies[name]; + raw = getCookieByAuthorizationBearerToken(req) - if (raw) { - if (raw.substr(0, 2) === 's:') { - val = unsigncookie(raw.slice(2), secrets); + } else { - if (val === false) { - debug('cookie signature invalid'); - val = undefined; - } - } else { - debug('cookie unsigned') + var header = req.headers.cookie; + + if (header) { + var cookies = cookie.parse(header); + + raw = cookies[name]; + } + } + + if (raw) { + if (raw.substr(0, 2) === 's:') { + val = unsigncookie(raw.slice(2), secrets); + + if (val === false) { + debug('cookie signature invalid'); + val = undefined; } + } else { + debug('cookie unsigned') } } From ef7fae88f1d0ad55453a57f02273ef9cbfdbfa47 Mon Sep 17 00:00:00 2001 From: nashibao Date: Wed, 28 Dec 2016 18:28:16 +0900 Subject: [PATCH 2/6] fix --- index.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/index.js b/index.js index efeaf0fa..9983c65c 100644 --- a/index.js +++ b/index.js @@ -552,6 +552,10 @@ function getcookie(req, name, secrets) { } } + if (req.useAuthorizationBearerToken) { + return val; + } + // back-compat read from cookieParser() signedCookies data if (!val && req.signedCookies) { val = req.signedCookies[name]; From 3a988cbb8e3f7eaaa0d13fe839c39a50718a073b Mon Sep 17 00:00:00 2001 From: nashibao Date: Thu, 5 Jan 2017 17:46:21 +0900 Subject: [PATCH 3/6] __customToken__ --- index.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/index.js b/index.js index 9983c65c..9d407ad2 100644 --- a/index.js +++ b/index.js @@ -528,6 +528,10 @@ function getcookie(req, name, secrets) { raw = getCookieByAuthorizationBearerToken(req) + } else if (req.__customToken__) { + + raw = req.__customToken__; + } else { var header = req.headers.cookie; From a0e3c83d385ee0ef92cb5660a8d0331f67992e12 Mon Sep 17 00:00:00 2001 From: nashibao Date: Fri, 6 Jan 2017 00:00:31 +0900 Subject: [PATCH 4/6] req.sessionSignedID --- index.js | 1 + 1 file changed, 1 insertion(+) diff --git a/index.js b/index.js index 9d407ad2..41348e35 100644 --- a/index.js +++ b/index.js @@ -215,6 +215,7 @@ function session(options) { // get the session ID from the cookie var cookieId = req.sessionID = getcookie(req, name, secrets); + req.sessionSignedID = 's:' + signature.sign(req.sessionID, secret[0]); // set-cookie onHeaders(res, function(){ From b8bf21c365c87b8401ab07fc46b0001855bab4b4 Mon Sep 17 00:00:00 2001 From: nashibao Date: Sat, 7 Jan 2017 09:25:19 +0900 Subject: [PATCH 5/6] sessionSignedID --- index.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/index.js b/index.js index 41348e35..ab283d1c 100644 --- a/index.js +++ b/index.js @@ -214,8 +214,9 @@ function session(options) { req.sessionStore = store; // get the session ID from the cookie - var cookieId = req.sessionID = getcookie(req, name, secrets); - req.sessionSignedID = 's:' + signature.sign(req.sessionID, secret[0]); + var ck_and_raw = getcookie(req, name, secrets) + var cookieId = req.sessionID = ck_and_raw[0]; + req.sessionSignedID = ck_and_raw[1]; // set-cookie onHeaders(res, function(){ @@ -558,7 +559,7 @@ function getcookie(req, name, secrets) { } if (req.useAuthorizationBearerToken) { - return val; + return [val, raw]; } // back-compat read from cookieParser() signedCookies data @@ -592,7 +593,7 @@ function getcookie(req, name, secrets) { } } - return val; + return [val, raw]; } /** From d962d26cd69f30b23e789c75530341bbdc866842 Mon Sep 17 00:00:00 2001 From: nashibao Date: Sat, 7 Jan 2017 09:34:38 +0900 Subject: [PATCH 6/6] fix: undefined secret --- index.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index ab283d1c..98f6ac12 100644 --- a/index.js +++ b/index.js @@ -156,7 +156,8 @@ function session(options) { // generates the new session store.generate = function(req){ req.sessionID = generateId(req); - req.sessionSignedID = 's:' + signature.sign(req.sessionID, secret[0]) + if(secret) + req.sessionSignedID = 's:' + signature.sign(req.sessionID, secret[0]) req.session = new Session(req); req.session.cookie = new Cookie(cookieOptions);