From d11efa72986d2ac433d9e827b5a10c8c707255c5 Mon Sep 17 00:00:00 2001 From: Jasper Haggenburg Date: Sun, 17 May 2015 17:38:02 +0200 Subject: [PATCH 1/4] allow manually setting of sessionID --- index.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index 6f6d1b52..adb9aa43 100644 --- a/index.js +++ b/index.js @@ -74,6 +74,7 @@ var defer = typeof setImmediate === 'function' * @param {Boolean} [options.resave] Resave unmodified sessions back to the store * @param {Boolean} [options.rolling] Enable/disable rolling session expiration * @param {Boolean} [options.saveUninitialized] Save uninitialized sessions to the store + * @param {Function} [options.sessionID] Manually set session ID * @param {String|Array} [options.secret] Secret for signing session ID * @param {Object} [options.store=MemoryStore] Session store * @param {String} [options.unset] @@ -94,7 +95,8 @@ function session(options){ var saveUninitializedSession = options.saveUninitialized; var secret = options.secret; - var generateId = options.genid || generateSessionId; + var getManualSessionId = options.sessionID; + var generateId = options.genid || getManualSessionId || generateSessionId; if (typeof generateId !== 'function') { throw new TypeError('genid option must be a function'); @@ -176,7 +178,7 @@ function session(options){ req.sessionStore = store; // get the session ID from the cookie - var cookieId = req.sessionID = getcookie(req, name, secrets); + var cookieId = req.sessionID = getManualSessionId ? getManualSessionId(req) : getcookie(req, name, secrets); // set-cookie onHeaders(res, function(){ From 2ba50bd4a14729b7b7f96a67f4d3d3875a5aa488 Mon Sep 17 00:00:00 2001 From: Jasper Haggenburg Date: Sun, 17 May 2015 17:51:46 +0200 Subject: [PATCH 2/4] properly generate new sessionID --- index.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/index.js b/index.js index adb9aa43..f99ddf32 100644 --- a/index.js +++ b/index.js @@ -95,8 +95,9 @@ function session(options){ var saveUninitializedSession = options.saveUninitialized; var secret = options.secret; - var getManualSessionId = options.sessionID; - var generateId = options.genid || getManualSessionId || generateSessionId; + var generateId = options.genid || generateSessionId; + + var getManualSessionId = options.sessionID || function(req) {}; if (typeof generateId !== 'function') { throw new TypeError('genid option must be a function'); @@ -139,7 +140,7 @@ function session(options){ // generates the new session store.generate = function(req){ - req.sessionID = generateId(req); + req.sessionID = getManualSessionId(req) ? getManualSessionId(req) : generateId(req); req.session = new Session(req); req.session.cookie = new Cookie(cookie); }; @@ -178,7 +179,7 @@ function session(options){ req.sessionStore = store; // get the session ID from the cookie - var cookieId = req.sessionID = getManualSessionId ? getManualSessionId(req) : getcookie(req, name, secrets); + var cookieId = req.sessionID = getManualSessionId(req) ? getManualSessionId(req) : getcookie(req, name, secrets); // set-cookie onHeaders(res, function(){ From f116bf9f2bf5d8f79bb0a08ebd252608fa77cbe6 Mon Sep 17 00:00:00 2001 From: Jasper Haggenburg Date: Sun, 17 May 2015 18:02:58 +0200 Subject: [PATCH 3/4] made option-name consistent with `genid` --- index.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index f99ddf32..b506def5 100644 --- a/index.js +++ b/index.js @@ -74,7 +74,7 @@ var defer = typeof setImmediate === 'function' * @param {Boolean} [options.resave] Resave unmodified sessions back to the store * @param {Boolean} [options.rolling] Enable/disable rolling session expiration * @param {Boolean} [options.saveUninitialized] Save uninitialized sessions to the store - * @param {Function} [options.sessionID] Manually set session ID + * @param {Function} [options.sessionid] Manually set session ID * @param {String|Array} [options.secret] Secret for signing session ID * @param {Object} [options.store=MemoryStore] Session store * @param {String} [options.unset] @@ -97,7 +97,7 @@ function session(options){ var generateId = options.genid || generateSessionId; - var getManualSessionId = options.sessionID || function(req) {}; + var getManualSessionId = options.sessionid || function(req) {}; if (typeof generateId !== 'function') { throw new TypeError('genid option must be a function'); From 9644e89e0f9e258db7d37ad0822ecd7915f6fb79 Mon Sep 17 00:00:00 2001 From: Jasper Haggenburg Date: Sun, 17 May 2015 18:03:56 +0200 Subject: [PATCH 4/4] added documentation for sessionid-option --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index 239d49b7..e7b83428 100644 --- a/README.md +++ b/README.md @@ -63,6 +63,24 @@ app.use(session({ })) ``` +##### sessionid + +Function to manually set the sessionID. This is most helpful for environments where +cookies are not possible. When the expression returns no value, the regular sessionID +will be used or generated. + +**NOTE** be careful with unsecured connections. When you don't use SSL, a man in the +middle could intercept a sessionID and pick up a session from there. + +```js +app.use(session({ + sessionid: function(req) { + return req.query.sessionID; + }, + secret: 'keyboard cat' +})) +``` + ##### name The name of the session ID cookie to set in the response (and read from in the