diff --git a/HISTORY.md b/HISTORY.md deleted file mode 100644 index 4fa89ab4..00000000 --- a/HISTORY.md +++ /dev/null @@ -1,436 +0,0 @@ -unreleased -========== - - * Fix `res.end` patch to always commit headers - * deps: cookie@0.4.1 - * deps: safe-buffer@5.2.1 - -1.17.1 / 2020-04-16 -=================== - - * Fix internal method wrapping error on failed reloads - -1.17.0 / 2019-10-10 -=================== - - * deps: cookie@0.4.0 - - Add `SameSite=None` support - * deps: safe-buffer@5.2.0 - -1.16.2 / 2019-06-12 -=================== - - * Fix restoring `cookie.originalMaxAge` when store returns `Date` - * deps: parseurl@~1.3.3 - -1.16.1 / 2019-04-11 -=================== - - * Fix error passing `data` option to `Cookie` constructor - * Fix uncaught error from bad session data - -1.16.0 / 2019-04-10 -=================== - - * Catch invalid `cookie.maxAge` value earlier - * Deprecate setting `cookie.maxAge` to a `Date` object - * Fix issue where `resave: false` may not save altered sessions - * Remove `utils-merge` dependency - * Use `safe-buffer` for improved Buffer API - * Use `Set-Cookie` as cookie header name for compatibility - * deps: depd@~2.0.0 - - Replace internal `eval` usage with `Function` constructor - - Use instance methods on `process` to check for listeners - - perf: remove argument reassignment - * deps: on-headers@~1.0.2 - - Fix `res.writeHead` patch missing return value - -1.15.6 / 2017-09-26 -=================== - - * deps: debug@2.6.9 - * deps: parseurl@~1.3.2 - - perf: reduce overhead for full URLs - - perf: unroll the "fast-path" `RegExp` - * deps: uid-safe@~2.1.5 - - perf: remove only trailing `=` - * deps: utils-merge@1.0.1 - -1.15.5 / 2017-08-02 -=================== - - * Fix `TypeError` when `req.url` is an empty string - * deps: depd@~1.1.1 - - Remove unnecessary `Buffer` loading - -1.15.4 / 2017-07-18 -=================== - - * deps: debug@2.6.8 - -1.15.3 / 2017-05-17 -=================== - - * deps: debug@2.6.7 - - deps: ms@2.0.0 - -1.15.2 / 2017-03-26 -=================== - - * deps: debug@2.6.3 - - Fix `DEBUG_MAX_ARRAY_LENGTH` - * deps: uid-safe@~2.1.4 - - Remove `base64-url` dependency - -1.15.1 / 2017-02-10 -=================== - - * deps: debug@2.6.1 - - Fix deprecation messages in WebStorm and other editors - - Undeprecate `DEBUG_FD` set to `1` or `2` - -1.15.0 / 2017-01-22 -=================== - - * Fix detecting modified session when session contains "cookie" property - * Fix resaving already-saved reloaded session at end of request - * deps: crc@3.4.4 - - perf: use `Buffer.from` when available - * deps: debug@2.6.0 - - Allow colors in workers - - Deprecated `DEBUG_FD` environment variable - - Use same color for same namespace - - Fix error when running under React Native - - deps: ms@0.7.2 - * perf: remove unreachable branch in set-cookie method - -1.14.2 / 2016-10-30 -=================== - - * deps: crc@3.4.1 - - Fix deprecation warning in Node.js 7.x - * deps: uid-safe@~2.1.3 - - deps: base64-url@1.3.3 - -1.14.1 / 2016-08-24 -=================== - - * Fix not always resetting session max age before session save - * Fix the cookie `sameSite` option to actually alter the `Set-Cookie` - * deps: uid-safe@~2.1.2 - - deps: base64-url@1.3.2 - -1.14.0 / 2016-07-01 -=================== - - * Correctly inherit from `EventEmitter` class in `Store` base class - * Fix issue where `Set-Cookie` `Expires` was not always updated - * Methods are no longer enumerable on `req.session` object - * deps: cookie@0.3.1 - - Add `sameSite` option - - Improve error message when `encode` is not a function - - Improve error message when `expires` is not a `Date` - - perf: enable strict mode - - perf: use for loop in parse - - perf: use string concatination for serialization - * deps: parseurl@~1.3.1 - - perf: enable strict mode - * deps: uid-safe@~2.1.1 - - Use `random-bytes` for byte source - - deps: base64-url@1.2.2 - * perf: enable strict mode - * perf: remove argument reassignment - -1.13.0 / 2016-01-10 -=================== - - * Fix `rolling: true` to not set cookie when no session exists - - Better `saveUninitialized: false` + `rolling: true` behavior - * deps: crc@3.4.0 - -1.12.1 / 2015-10-29 -=================== - - * deps: cookie@0.2.3 - - Fix cookie `Max-Age` to never be a floating point number - -1.12.0 / 2015-10-25 -=================== - - * Support the value `'auto'` in the `cookie.secure` option - * deps: cookie@0.2.2 - - Throw on invalid values provided to `serialize` - * deps: depd@~1.1.0 - - Enable strict mode in more places - - Support web browser loading - * deps: on-headers@~1.0.1 - - perf: enable strict mode - -1.11.3 / 2015-05-22 -=================== - - * deps: cookie@0.1.3 - - Slight optimizations - * deps: crc@3.3.0 - -1.11.2 / 2015-05-10 -=================== - - * deps: debug@~2.2.0 - - deps: ms@0.7.1 - * deps: uid-safe@~2.0.0 - -1.11.1 / 2015-04-08 -=================== - - * Fix mutating `options.secret` value - -1.11.0 / 2015-04-07 -=================== - - * Support an array in `secret` option for key rotation - * deps: depd@~1.0.1 - -1.10.4 / 2015-03-15 -=================== - - * deps: debug@~2.1.3 - - Fix high intensity foreground color for bold - - deps: ms@0.7.0 - -1.10.3 / 2015-02-16 -=================== - - * deps: cookie-signature@1.0.6 - * deps: uid-safe@1.1.0 - - Use `crypto.randomBytes`, if available - - deps: base64-url@1.2.1 - -1.10.2 / 2015-01-31 -=================== - - * deps: uid-safe@1.0.3 - - Fix error branch that would throw - - deps: base64-url@1.2.0 - -1.10.1 / 2015-01-08 -=================== - - * deps: uid-safe@1.0.2 - - Remove dependency on `mz` - -1.10.0 / 2015-01-05 -=================== - - * Add `store.touch` interface for session stores - * Fix `MemoryStore` expiration with `resave: false` - * deps: debug@~2.1.1 - -1.9.3 / 2014-12-02 -================== - - * Fix error when `req.sessionID` contains a non-string value - -1.9.2 / 2014-11-22 -================== - - * deps: crc@3.2.1 - - Minor fixes - -1.9.1 / 2014-10-22 -================== - - * Remove unnecessary empty write call - - Fixes Node.js 0.11.14 behavior change - - Helps work-around Node.js 0.10.1 zlib bug - -1.9.0 / 2014-09-16 -================== - - * deps: debug@~2.1.0 - - Implement `DEBUG_FD` env variable support - * deps: depd@~1.0.0 - -1.8.2 / 2014-09-15 -================== - - * Use `crc` instead of `buffer-crc32` for speed - * deps: depd@0.4.5 - -1.8.1 / 2014-09-08 -================== - - * Keep `req.session.save` non-enumerable - * Prevent session prototype methods from being overwritten - -1.8.0 / 2014-09-07 -================== - - * Do not resave already-saved session at end of request - * deps: cookie-signature@1.0.5 - * deps: debug@~2.0.0 - -1.7.6 / 2014-08-18 -================== - - * Fix exception on `res.end(null)` calls - -1.7.5 / 2014-08-10 -================== - - * Fix parsing original URL - * deps: on-headers@~1.0.0 - * deps: parseurl@~1.3.0 - -1.7.4 / 2014-08-05 -================== - - * Fix response end delay for non-chunked responses - -1.7.3 / 2014-08-05 -================== - - * Fix `res.end` patch to call correct upstream `res.write` - -1.7.2 / 2014-07-27 -================== - - * deps: depd@0.4.4 - - Work-around v8 generating empty stack traces - -1.7.1 / 2014-07-26 -================== - - * deps: depd@0.4.3 - - Fix exception when global `Error.stackTraceLimit` is too low - -1.7.0 / 2014-07-22 -================== - - * Improve session-ending error handling - - Errors are passed to `next(err)` instead of `console.error` - * deps: debug@1.0.4 - * deps: depd@0.4.2 - - Add `TRACE_DEPRECATION` environment variable - - Remove non-standard grey color from color output - - Support `--no-deprecation` argument - - Support `--trace-deprecation` argument - -1.6.5 / 2014-07-11 -================== - - * Do not require `req.originalUrl` - * deps: debug@1.0.3 - - Add support for multiple wildcards in namespaces - -1.6.4 / 2014-07-07 -================== - - * Fix blank responses for stores with synchronous operations - -1.6.3 / 2014-07-04 -================== - - * Fix resave deprecation message - -1.6.2 / 2014-07-04 -================== - - * Fix confusing option deprecation messages - -1.6.1 / 2014-06-28 -================== - - * Fix saveUninitialized deprecation message - -1.6.0 / 2014-06-28 -================== - - * Add deprecation message to undefined `resave` option - * Add deprecation message to undefined `saveUninitialized` option - * Fix `res.end` patch to return correct value - * Fix `res.end` patch to handle multiple `res.end` calls - * Reject cookies with missing signatures - -1.5.2 / 2014-06-26 -================== - - * deps: cookie-signature@1.0.4 - - fix for timing attacks - -1.5.1 / 2014-06-21 -================== - - * Move hard-to-track-down `req.secret` deprecation message - -1.5.0 / 2014-06-19 -================== - - * Debug name is now "express-session" - * Deprecate integration with `cookie-parser` middleware - * Deprecate looking for secret in `req.secret` - * Directly read cookies; `cookie-parser` no longer required - * Directly set cookies; `res.cookie` no longer required - * Generate session IDs with `uid-safe`, faster and even less collisions - -1.4.0 / 2014-06-17 -================== - - * Add `genid` option to generate custom session IDs - * Add `saveUninitialized` option to control saving uninitialized sessions - * Add `unset` option to control unsetting `req.session` - * Generate session IDs with `rand-token` by default; reduce collisions - * deps: buffer-crc32@0.2.3 - -1.3.1 / 2014-06-14 -================== - - * Add description in package for npmjs.org listing - -1.3.0 / 2014-06-14 -================== - - * Integrate with express "trust proxy" by default - * deps: debug@1.0.2 - -1.2.1 / 2014-05-27 -================== - - * Fix `resave` such that `resave: true` works - -1.2.0 / 2014-05-19 -================== - - * Add `resave` option to control saving unmodified sessions - -1.1.0 / 2014-05-12 -================== - - * Add `name` option; replacement for `key` option - * Use `setImmediate` in MemoryStore for node.js >= 0.10 - -1.0.4 / 2014-04-27 -================== - - * deps: debug@0.8.1 - -1.0.3 / 2014-04-19 -================== - - * Use `res.cookie()` instead of `res.setHeader()` - * deps: cookie@0.1.2 - -1.0.2 / 2014-02-23 -================== - - * Add missing dependency to `package.json` - -1.0.1 / 2014-02-15 -================== - - * Add missing dependencies to `package.json` - -1.0.0 / 2014-02-15 -================== - - * Genesis from `connect` diff --git a/README.md b/README.md index 38b75c7c..b95619f5 100644 --- a/README.md +++ b/README.md @@ -1,877 +1,28 @@ # express-session -[![NPM Version][npm-version-image]][npm-url] -[![NPM Downloads][npm-downloads-image]][node-url] -[![Build Status][travis-image]][travis-url] -[![Test Coverage][coveralls-image]][coveralls-url] +对express-session功能增强。可同时设置两个 `Set-cookie` -## Installation +## 设置一个 -This is a [Node.js](https://nodejs.org/en/) module available through the -[npm registry](https://www.npmjs.com/). Installation is done using the -[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): +同 [github](https://github.com/expressjs/session) +## 设置两个 -```sh -$ npm install express-session -``` - -## API - -```js -var session = require('express-session') -``` - -### session(options) - -Create a session middleware with the given `options`. - -**Note** Session data is _not_ saved in the cookie itself, just the session ID. -Session data is stored server-side. - -**Note** Since version 1.5.0, the [`cookie-parser` middleware](https://www.npmjs.com/package/cookie-parser) -no longer needs to be used for this module to work. This module now directly reads -and writes cookies on `req`/`res`. Using `cookie-parser` may result in issues -if the `secret` is not the same between this module and `cookie-parser`. - -**Warning** The default server-side session storage, `MemoryStore`, is _purposely_ -not designed for a production environment. It will leak memory under most -conditions, does not scale past a single process, and is meant for debugging and -developing. - -For a list of stores, see [compatible session stores](#compatible-session-stores). - -#### Options - -`express-session` accepts these properties in the options object. - -##### cookie - -Settings object for the session ID cookie. The default value is -`{ path: '/', httpOnly: true, secure: false, maxAge: null }`. - -The following are options that can be set in this object. - -##### cookie.domain - -Specifies the value for the `Domain` `Set-Cookie` attribute. By default, no domain -is set, and most clients will consider the cookie to apply to only the current -domain. - -##### cookie.expires - -Specifies the `Date` object to be the value for the `Expires` `Set-Cookie` attribute. -By default, no expiration is set, and most clients will consider this a -"non-persistent cookie" and will delete it on a condition like exiting a web browser -application. - -**Note** If both `expires` and `maxAge` are set in the options, then the last one -defined in the object is what is used. - -**Note** The `expires` option should not be set directly; instead only use the `maxAge` -option. - -##### cookie.httpOnly - -Specifies the `boolean` value for the `HttpOnly` `Set-Cookie` attribute. When truthy, -the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` -attribute is set. - -**Note** be careful when setting this to `true`, as compliant clients will not allow -client-side JavaScript to see the cookie in `document.cookie`. - -##### cookie.maxAge - -Specifies the `number` (in milliseconds) to use when calculating the `Expires` -`Set-Cookie` attribute. This is done by taking the current server time and adding -`maxAge` milliseconds to the value to calculate an `Expires` datetime. By default, -no maximum age is set. - -**Note** If both `expires` and `maxAge` are set in the options, then the last one -defined in the object is what is used. - -##### cookie.path - -Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which -is the root path of the domain. - -##### cookie.sameSite - -Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute. - - - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement. - - `false` will not set the `SameSite` attribute. - - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement. - - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie. - - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement. - -More information about the different enforcement levels can be found in -[the specification][rfc-6265bis-03-4.1.2.7]. - -**Note** This is an attribute that has not yet been fully standardized, and may change in -the future. This also means many clients may ignore this attribute until they understand it. - -##### cookie.secure - -Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy, -the `Secure` attribute is set, otherwise it is not. By default, the `Secure` -attribute is not set. +两个 Cookie 都用于记录同一个sid，但一个设置为 SameSite: None; Secure，另外一个使用默认值。 +然后在处理 Session 时，兼容这两种 Cookie -**Note** be careful when setting this to `true`, as compliant clients will not send -the cookie back to the server in the future if the browser does not have an HTTPS -connection. +```javascript +const session = require('session'); -Please note that `secure: true` is a **recommended** option. However, it requires -an https-enabled website, i.e., HTTPS is necessary for secure cookies. If `secure` -is set, and you access your site over HTTP, the cookie will not be set. If you -have your node.js behind a proxy and are using `secure: true`, you need to set -"trust proxy" in express: - -```js -var app = express() -app.set('trust proxy', 1) // trust first proxy -app.use(session({ - secret: 'keyboard cat', - resave: false, - saveUninitialized: true, - cookie: { secure: true } -})) -``` - -For using secure cookies in production, but allowing for testing in development, -the following is an example of enabling this setup based on `NODE_ENV` in express: - -```js -var app = express() -var sess = { - secret: 'keyboard cat', - cookie: {} -} - -if (app.get('env') === 'production') { - app.set('trust proxy', 1) // trust first proxy - sess.cookie.secure = true // serve secure cookies -} - -app.use(session(sess)) -``` - -The `cookie.secure` option can also be set to the special value `'auto'` to have -this setting automatically match the determined security of the connection. Be -careful when using this setting if the site is available both as HTTP and HTTPS, -as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This -is useful when the Express `"trust proxy"` setting is properly setup to simplify -development vs production configuration. - -##### genid - -Function to call to generate a new session ID. Provide a function that returns -a string that will be used as a session ID. The function is given `req` as the -first argument if you want to use some value attached to `req` when generating -the ID. - -The default value is a function which uses the `uid-safe` library to generate IDs. - -**NOTE** be careful to generate unique IDs so your sessions do not conflict. - -```js -app.use(session({ - genid: function(req) { - return genuuid() // use UUIDs for session IDs - }, - secret: 'keyboard cat' -})) +app.use(session( + { + secret: 'keyboard cat', + name: 'first', + cookie: {maxAge: 60000, samesiteWithoutSecure: true} + })); ``` -##### name - -The name of the session ID cookie to set in the response (and read from in the -request). - -The default value is `'connect.sid'`. - -**Note** if you have multiple apps running on the same hostname (this is just -the name, i.e. `localhost` or `127.0.0.1`; different schemes and ports do not -name a different hostname), then you need to separate the session cookies from -each other. The simplest method is to simply set different `name`s per app. - -##### proxy - -Trust the reverse proxy when setting secure cookies (via the "X-Forwarded-Proto" -header). - -The default value is `undefined`. - - - `true` The "X-Forwarded-Proto" header will be used. - - `false` All headers are ignored and the connection is considered secure only - if there is a direct TLS/SSL connection. - - `undefined` Uses the "trust proxy" setting from express - -##### resave - -Forces the session to be saved back to the session store, even if the session -was never modified during the request. Depending on your store this may be -necessary, but it can also create race conditions where a client makes two -parallel requests to your server and changes made to the session in one -request may get overwritten when the other request ends, even if it made no -changes (this behavior also depends on what store you're using). - -The default value is `true`, but using the default has been deprecated, -as the default will change in the future. Please research into this setting -and choose what is appropriate to your use-case. Typically, you'll want -`false`. - -How do I know if this is necessary for my store? The best way to know is to -check with your store if it implements the `touch` method. If it does, then -you can safely set `resave: false`. If it does not implement the `touch` -method and your store sets an expiration date on stored sessions, then you -likely need `resave: true`. - -##### rolling - -Force the session identifier cookie to be set on every response. The expiration -is reset to the original [`maxAge`](#cookiemaxage), resetting the expiration -countdown. - -The default value is `false`. - -With this enabled, the session identifier cookie will expire in -[`maxAge`](#cookiemaxage) since the last response was sent instead of in -[`maxAge`](#cookiemaxage) since the session was last modified by the server. - -This is typically used in conjuction with short, non-session-length -[`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data -with reduced potential of it occurring during on going server interactions. - -**Note** When this option is set to `true` but the `saveUninitialized` option is -set to `false`, the cookie will not be set on a response with an uninitialized -session. This option only modifies the behavior when an existing session was -loaded for the request. - -##### saveUninitialized - -Forces a session that is "uninitialized" to be saved to the store. A session is -uninitialized when it is new but not modified. Choosing `false` is useful for -implementing login sessions, reducing server storage usage, or complying with -laws that require permission before setting a cookie. Choosing `false` will also -help with race conditions where a client makes multiple parallel requests -without a session. - -The default value is `true`, but using the default has been deprecated, as the -default will change in the future. Please research into this setting and -choose what is appropriate to your use-case. - -**Note** if you are using Session in conjunction with PassportJS, Passport -will add an empty Passport object to the session for use after a user is -authenticated, which will be treated as a modification to the session, causing -it to be saved. *This has been fixed in PassportJS 0.3.0* - -##### secret - -**Required option** - -This is the secret used to sign the session ID cookie. This can be either a string -for a single secret, or an array of multiple secrets. If an array of secrets is -provided, only the first element will be used to sign the session ID cookie, while -all the elements will be considered when verifying the signature in requests. The -secret itself should be not easily parsed by a human and would best be a random set -of characters. A best practice may include: - - - The use of environment variables to store the secret, ensuring the secret itself - does not exist in your repository. - - Periodic updates of the secret, while ensuring the previous secret is in the - array. - -Using a secret that cannot be guessed will reduce the ability to hijack a session to -only guessing the session ID (as determined by the `genid` option). - -Changing the secret value will invalidate all existing sessions. In order to rotate -the secret without invalidating sessions, provide an array of secrets, with the new -secret as first element of the array, and including previous secrets as the later -elements. - -##### store - -The session store instance, defaults to a new `MemoryStore` instance. - -##### unset - -Control the result of unsetting `req.session` (through `delete`, setting to `null`, -etc.). - -The default value is `'keep'`. - - - `'destroy'` The session will be destroyed (deleted) when the response ends. - - `'keep'` The session in the store will be kept, but modifications made during - the request are ignored and not saved. - -### req.session - -To store or access session data, simply use the request property `req.session`, -which is (generally) serialized as JSON by the store, so nested objects -are typically fine. For example below is a user-specific view counter: - -```js -// Use the session middleware -app.use(session({ secret: 'keyboard cat', cookie: { maxAge: 60000 }})) - -// Access the session as req.session -app.get('/', function(req, res, next) { - if (req.session.views) { - req.session.views++ - res.setHeader('Content-Type', 'text/html') - res.write('

views: ' + req.session.views + '

') - res.write('

expires in: ' + (req.session.cookie.maxAge / 1000) + 's

') - res.end() - } else { - req.session.views = 1 - res.end('welcome to the session demo. refresh!') - } -}) -``` - -#### Session.regenerate(callback) - -To regenerate the session simply invoke the method. Once complete, -a new SID and `Session` instance will be initialized at `req.session` -and the `callback` will be invoked. - -```js -req.session.regenerate(function(err) { - // will have a new session here -}) -``` - -#### Session.destroy(callback) - -Destroys the session and will unset the `req.session` property. -Once complete, the `callback` will be invoked. - -```js -req.session.destroy(function(err) { - // cannot access session here -}) -``` - -#### Session.reload(callback) - -Reloads the session data from the store and re-populates the -`req.session` object. Once complete, the `callback` will be invoked. - -```js -req.session.reload(function(err) { - // session updated -}) -``` - -#### Session.save(callback) - -Save the session back to the store, replacing the contents on the store with the -contents in memory (though a store may do something else--consult the store's -documentation for exact behavior). - -This method is automatically called at the end of the HTTP response if the -session data has been altered (though this behavior can be altered with various -options in the middleware constructor). Because of this, typically this method -does not need to be called. - -There are some cases where it is useful to call this method, for example, -redirects, long-lived requests or in WebSockets. - -```js -req.session.save(function(err) { - // session saved -}) -``` - -#### Session.touch() - -Updates the `.maxAge` property. Typically this is -not necessary to call, as the session middleware does this for you. - -### req.session.id - -Each session has a unique ID associated with it. This property is an -alias of [`req.sessionID`](#reqsessionid-1) and cannot be modified. -It has been added to make the session ID accessible from the `session` -object. - -### req.session.cookie - -Each session has a unique cookie object accompany it. This allows -you to alter the session cookie per visitor. For example we can -set `req.session.cookie.expires` to `false` to enable the cookie -to remain for only the duration of the user-agent. - -#### Cookie.maxAge - -Alternatively `req.session.cookie.maxAge` will return the time -remaining in milliseconds, which we may also re-assign a new value -to adjust the `.expires` property appropriately. The following -are essentially equivalent - -```js -var hour = 3600000 -req.session.cookie.expires = new Date(Date.now() + hour) -req.session.cookie.maxAge = hour -``` - -For example when `maxAge` is set to `60000` (one minute), and 30 seconds -has elapsed it will return `30000` until the current request has completed, -at which time `req.session.touch()` is called to reset -`req.session.cookie.maxAge` to its original value. - -```js -req.session.cookie.maxAge // => 30000 -``` - -#### Cookie.originalMaxAge - -The `req.session.cookie.originalMaxAge` property returns the original -`maxAge` (time-to-live), in milliseconds, of the session cookie. - -### req.sessionID - -To get the ID of the loaded session, access the request property -`req.sessionID`. This is simply a read-only value set when a session -is loaded/created. - -## Session Store Implementation - -Every session store _must_ be an `EventEmitter` and implement specific -methods. The following methods are the list of **required**, **recommended**, -and **optional**. - - * Required methods are ones that this module will always call on the store. - * Recommended methods are ones that this module will call on the store if - available. - * Optional methods are ones this module does not call at all, but helps - present uniform stores to users. - -For an example implementation view the [connect-redis](http://github.com/visionmedia/connect-redis) repo. - -### store.all(callback) - -**Optional** - -This optional method is used to get all sessions in the store as an array. The -`callback` should be called as `callback(error, sessions)`. - -### store.destroy(sid, callback) - -**Required** - -This required method is used to destroy/delete a session from the store given -a session ID (`sid`). The `callback` should be called as `callback(error)` once -the session is destroyed. - -### store.clear(callback) - -**Optional** - -This optional method is used to delete all sessions from the store. The -`callback` should be called as `callback(error)` once the store is cleared. - -### store.length(callback) - -**Optional** - -This optional method is used to get the count of all sessions in the store. -The `callback` should be called as `callback(error, len)`. - -### store.get(sid, callback) - -**Required** - -This required method is used to get a session from the store given a session -ID (`sid`). The `callback` should be called as `callback(error, session)`. - -The `session` argument should be a session if found, otherwise `null` or -`undefined` if the session was not found (and there was no error). A special -case is made when `error.code === 'ENOENT'` to act like `callback(null, null)`. - -### store.set(sid, session, callback) - -**Required** - -This required method is used to upsert a session into the store given a -session ID (`sid`) and session (`session`) object. The callback should be -called as `callback(error)` once the session has been set in the store. - -### store.touch(sid, session, callback) - -**Recommended** - -This recommended method is used to "touch" a given session given a -session ID (`sid`) and session (`session`) object. The `callback` should be -called as `callback(error)` once the session has been touched. - -This is primarily used when the store will automatically delete idle sessions -and this method is used to signal to the store the given session is active, -potentially resetting the idle timer. - -## Compatible Session Stores - -The following modules implement a session store that is compatible with this -module. Please make a PR to add additional modules :) - -[![★][aerospike-session-store-image] aerospike-session-store][aerospike-session-store-url] A session store using [Aerospike](http://www.aerospike.com/). - -[aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store -[aerospike-session-store-image]: https://badgen.net/github/stars/aerospike/aerospike-session-store-expressjs?label=%E2%98%85 - -[![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store. - -[cassandra-store-url]: https://www.npmjs.com/package/cassandra-store -[cassandra-store-image]: https://badgen.net/github/stars/webcc/cassandra-store?label=%E2%98%85 - -[![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded -stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2 -and other multi-core embedded devices). - -[cluster-store-url]: https://www.npmjs.com/package/cluster-store -[cluster-store-image]: https://badgen.net/github/stars/coolaj86/cluster-store?label=%E2%98%85 - -[![★][connect-arango-image] connect-arango][connect-arango-url] An ArangoDB-based session store. - -[connect-arango-url]: https://www.npmjs.com/package/connect-arango -[connect-arango-image]: https://badgen.net/github/stars/AlexanderArvidsson/connect-arango?label=%E2%98%85 - -[![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store. - -[connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables -[connect-azuretables-image]: https://badgen.net/github/stars/mike-goodwin/connect-azuretables?label=%E2%98%85 - -[![★][connect-cloudant-store-image] connect-cloudant-store][connect-cloudant-store-url] An [IBM Cloudant](https://cloudant.com/)-based session store. - -[connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store -[connect-cloudant-store-image]: https://badgen.net/github/stars/adriantanasa/connect-cloudant-store?label=%E2%98%85 - -[![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store. - -[connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase -[connect-couchbase-image]: https://badgen.net/github/stars/christophermina/connect-couchbase?label=%E2%98%85 - -[![★][connect-datacache-image] connect-datacache][connect-datacache-url] An [IBM Bluemix Data Cache](http://www.ibm.com/cloud-computing/bluemix/)-based session store. - -[connect-datacache-url]: https://www.npmjs.com/package/connect-datacache -[connect-datacache-image]: https://badgen.net/github/stars/adriantanasa/connect-datacache?label=%E2%98%85 - -[![★][@google-cloud/connect-datastore-image] @google-cloud/connect-datastore][@google-cloud/connect-datastore-url] A [Google Cloud Datastore](https://cloud.google.com/datastore/docs/concepts/overview)-based session store. - -[@google-cloud/connect-datastore-url]: https://www.npmjs.com/package/@google-cloud/connect-datastore -[@google-cloud/connect-datastore-image]: https://badgen.net/github/stars/GoogleCloudPlatform/cloud-datastore-session-node?label=%E2%98%85 - -[![★][connect-db2-image] connect-db2][connect-db2-url] An IBM DB2-based session store built using [ibm_db](https://www.npmjs.com/package/ibm_db) module. - -[connect-db2-url]: https://www.npmjs.com/package/connect-db2 -[connect-db2-image]: https://badgen.net/github/stars/wallali/connect-db2?label=%E2%98%85 - -[![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store. - -[connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb -[connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85 - -[![★][@google-cloud/connect-firestore-image] @google-cloud/connect-firestore][@google-cloud/connect-firestore-url] A [Google Cloud Firestore](https://cloud.google.com/firestore/docs/overview)-based session store. - -[@google-cloud/connect-firestore-url]: https://www.npmjs.com/package/@google-cloud/connect-firestore -[@google-cloud/connect-firestore-image]: https://badgen.net/github/stars/googleapis/nodejs-firestore-session?label=%E2%98%85 - -[![★][connect-hazelcast-image] connect-hazelcast][connect-hazelcast-url] Hazelcast session store for Connect and Express. - -[connect-hazelcast-url]: https://www.npmjs.com/package/connect-hazelcast -[connect-hazelcast-image]: https://badgen.net/github/stars/huseyinbabal/connect-hazelcast?label=%E2%98%85 - -[![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store. - -[connect-loki-url]: https://www.npmjs.com/package/connect-loki -[connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85 - -[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store. - -[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached -[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85 - -[![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using -[memjs](https://www.npmjs.com/package/memjs) as the memcached client. - -[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs -[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85 - -[![★][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store. - -[connect-ml-url]: https://www.npmjs.com/package/connect-ml -[connect-ml-image]: https://badgen.net/github/stars/bluetorch/connect-ml?label=%E2%98%85 - -[![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store. - -[connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb -[connect-monetdb-image]: https://badgen.net/github/stars/MonetDB/npm-connect-monetdb?label=%E2%98%85 - -[![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store. - -[connect-mongo-url]: https://www.npmjs.com/package/connect-mongo -[connect-mongo-image]: https://badgen.net/github/stars/kcbanner/connect-mongo?label=%E2%98%85 - -[![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB. - -[connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session -[connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85 - -[![★][connect-mssql-v2-image] connect-mssql-v2][connect-mssql-v2-url] A Microsoft SQL Server-based session store based on [connect-mssql](https://www.npmjs.com/package/connect-mssql). - -[connect-mssql-v2-url]: https://www.npmjs.com/package/connect-mssql-v2 -[connect-mssql-v2-image]: https://badgen.net/github/stars/jluboff/connect-mssql-v2?label=%E2%98%85 - -[![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store. - -[connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple -[connect-pg-simple-image]: https://badgen.net/github/stars/voxpelli/node-connect-pg-simple?label=%E2%98%85 - -[![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store. - -[connect-redis-url]: https://www.npmjs.com/package/connect-redis -[connect-redis-image]: https://badgen.net/github/stars/tj/connect-redis?label=%E2%98%85 - -[![★][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/) - -[connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase -[connect-session-firebase-image]: https://badgen.net/github/stars/benweier/connect-session-firebase?label=%E2%98%85 - -[![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using -[Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle. - -[connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex -[connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85 - -[![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using -[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL. - -[connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize -[connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85 - -[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store. - -[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3 -[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85 - -[![★][connect-typeorm-image] connect-typeorm][connect-typeorm-url] A [TypeORM](https://github.com/typeorm/typeorm)-based session store. - -[connect-typeorm-url]: https://www.npmjs.com/package/connect-typeorm -[connect-typeorm-image]: https://badgen.net/github/stars/makepost/connect-typeorm?label=%E2%98%85 - -[![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store. - -[couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression -[couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85 - -[![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store. - -[dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store -[dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85 - -[![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store. - -[express-etcd-url]: https://www.npmjs.com/package/express-etcd -[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85 - -[![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native -[MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module. - -[express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session -[express-mysql-session-image]: https://badgen.net/github/stars/chill117/express-mysql-session?label=%E2%98%85 - -[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store. - -[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session -[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85 - -[![★][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native -[oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module. - -[express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session -[express-oracle-session-image]: https://badgen.net/github/stars/slumber86/express-oracle-session?label=%E2%98%85 - -[![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url] -A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports -a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines). - -[express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager -[express-session-cache-manager-image]: https://badgen.net/github/stars/theogravity/express-session-cache-manager?label=%E2%98%85 - -[![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store. - -[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3 -[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85 - -[![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store. - -[express-session-level-url]: https://www.npmjs.com/package/express-session-level -[express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85 - -[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerfull, flat file database. - -[express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb -[express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85 - -[![★][express-sessions-image] express-sessions][express-sessions-url] A session store supporting both MongoDB and Redis. - -[express-sessions-url]: https://www.npmjs.com/package/express-sessions -[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85 - -[![★][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store. - -[firestore-store-url]: https://www.npmjs.com/package/firestore-store -[firestore-store-image]: https://badgen.net/github/stars/hendrysadrak/firestore-store?label=%E2%98%85 - -[![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune) -based session store. Supports all backends supported by Fortune (MongoDB, Redis, Postgres, NeDB). - -[fortune-session-url]: https://www.npmjs.com/package/fortune-session -[fortune-session-image]: https://badgen.net/github/stars/aliceklipper/fortune-session?label=%E2%98%85 - -[![★][hazelcast-store-image] hazelcast-store][hazelcast-store-url] A Hazelcast-based session store built on the [Hazelcast Node Client](https://www.npmjs.com/package/hazelcast-client). - -[hazelcast-store-url]: https://www.npmjs.com/package/hazelcast-store -[hazelcast-store-image]: https://badgen.net/github/stars/jackspaniel/hazelcast-store?label=%E2%98%85 - -[![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store. - -[level-session-store-url]: https://www.npmjs.com/package/level-session-store -[level-session-store-image]: https://badgen.net/github/stars/toddself/level-session-store?label=%E2%98%85 - -[![★][lowdb-session-store-image] lowdb-session-store][lowdb-session-store-url] A [lowdb](https://www.npmjs.com/package/lowdb)-based session store. - -[lowdb-session-store-url]: https://www.npmjs.com/package/lowdb-session-store -[lowdb-session-store-image]: https://badgen.net/github/stars/fhellwig/lowdb-session-store?label=%E2%98%85 - -[![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store. - -[medea-session-store-url]: https://www.npmjs.com/package/medea-session-store -[medea-session-store-image]: https://badgen.net/github/stars/BenjaminVadant/medea-session-store?label=%E2%98%85 - -[![★][memorystore-image] memorystore][memorystore-url] A memory session store made for production. - -[memorystore-url]: https://www.npmjs.com/package/memorystore -[memorystore-image]: https://badgen.net/github/stars/roccomuso/memorystore?label=%E2%98%85 - -[![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store. - -[mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store -[mssql-session-store-image]: https://badgen.net/github/stars/jwathen/mssql-session-store?label=%E2%98%85 - -[![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store. - -[nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store -[nedb-session-store-image]: https://badgen.net/github/stars/JamesMGreene/nedb-session-store?label=%E2%98%85 - -[![★][@quixo3/prisma-session-store-image] @quixo3/prisma-session-store][@quixo3/prisma-session-store-url] A session store for the [Prisma Framework](https://www.prisma.io). - -[@quixo3/prisma-session-store-url]: https://www.npmjs.com/package/@quixo3/prisma-session-store -[@quixo3/prisma-session-store-image]: https://badgen.net/github/stars/kleydon/prisma-session-store?label=%E2%98%85 - -[![★][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API - -[restsession-url]: https://www.npmjs.com/package/restsession -[restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85 - -[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/). - -[sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect -[sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85 - -[![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store. - -[session-file-store-url]: https://www.npmjs.com/package/session-file-store -[session-file-store-image]: https://badgen.net/github/stars/valery-barysok/session-file-store?label=%E2%98%85 - -[![★][session-pouchdb-store-image] session-pouchdb-store][session-pouchdb-store-url] Session store for PouchDB / CouchDB. Accepts embedded, custom, or remote PouchDB instance and realtime synchronization. - -[session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store -[session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85 - -[![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store. - -[session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb -[session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85 - -[![★][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases. - -[sessionstore-url]: https://www.npmjs.com/package/sessionstore -[sessionstore-image]: https://badgen.net/github/stars/adrai/sessionstore?label=%E2%98%85 - -[![★][tch-nedb-session-image] tch-nedb-session][tch-nedb-session-url] A file system session store based on NeDB. - -[tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session -[tch-nedb-session-image]: https://badgen.net/github/stars/tomaschyly/NeDBSession?label=%E2%98%85 - -## Example - -A simple example using `express-session` to store page views for a user. - -```js -var express = require('express') -var parseurl = require('parseurl') -var session = require('express-session') - -var app = express() - -app.use(session({ - secret: 'keyboard cat', - resave: false, - saveUninitialized: true -})) - -app.use(function (req, res, next) { - if (!req.session.views) { - req.session.views = {} - } - - // get the url pathname - var pathname = parseurl(req).pathname - - // count the views - req.session.views[pathname] = (req.session.views[pathname] || 0) + 1 - - next() -}) - -app.get('/foo', function (req, res, next) { - res.send('you viewed this page ' + req.session.views['/foo'] + ' times') -}) - -app.get('/bar', function (req, res, next) { - res.send('you viewed this page ' + req.session.views['/bar'] + ' times') -}) -``` - -## Debugging - -This module uses the [debug](https://www.npmjs.com/package/debug) module -internally to log information about session operations. - -To see all the internal logs, set the `DEBUG` environment variable to -`express-session` when launching your app (`npm start`, in this example): - -```sh -$ DEBUG=express-session npm start -``` - -On Windows, use the corresponding command; - -```sh -> set DEBUG=express-session & npm start -``` - -## License - -[MIT](LICENSE) +### 使用哪一个name -[rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7 -[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master -[coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master -[node-url]: https://nodejs.org/en/download -[npm-downloads-image]: https://badgen.net/npm/dm/express-session -[npm-url]: https://npmjs.org/package/express-session -[npm-version-image]: https://badgen.net/npm/v/express-session -[travis-image]: https://badgen.net/travis/expressjs/session/master -[travis-url]: https://travis-ci.org/expressjs/session +获取cookieID 时，如果同时设置了两个 `Set-cookie`, 那么， +- 当请求协议为 **HTTP** 时，则使用第一个配置项中的name，例如上面例子中的`first` +- 当请求协议为 **HTTPS** 时，则在传递的name的基础上拼接'-secure'，例如上面例子,就会变成中的`first-secure` \ No newline at end of file diff --git a/index.js b/index.js index d7efeab9..788249d8 100644 --- a/index.js +++ b/index.js @@ -71,6 +71,7 @@ var defer = typeof setImmediate === 'function' * * @param {Object} [options] * @param {Object} [options.cookie] Options for cookie + * @param {Object} [options.cookie.samesiteWithoutSecure] Options for cookie * @param {Function} [options.genid] * @param {String} [options.name=connect.sid] Session ID cookie name * @param {Boolean} [options.proxy] @@ -93,9 +94,15 @@ function session(options) { // get the session id generate function var generateId = opts.genid || generateSessionId + // get the https special confing + var samesiteWithoutSecure = cookieOptions.samesiteWithoutSecure || false + // get the session cookie name var name = opts.name || opts.key || 'connect.sid' + // get the special session cookie name + var _name = name + '-secure' + // get the session store var store = opts.store || new MemoryStore() @@ -215,6 +222,9 @@ function session(options) { // get the session ID from the cookie var cookieId = req.sessionID = getcookie(req, name, secrets); + if (!cookieId) { + cookieId = req.sessionID = getcookie(req, _name, secrets); + } // set-cookie onHeaders(res, function(){ @@ -240,7 +250,13 @@ function session(options) { } // set cookie - setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data); + var setCookieData = req.session.cookie.data; + setcookie(res, name, req.sessionID, secrets[0], setCookieData); + if (samesiteWithoutSecure) { + setCookieData.sameSite = 'None'; + setCookieData.secure = 'Secure'; + setcookie(res, _name, req.sessionID, secrets[0], setCookieData); + } }); // proxy end() to commit the session diff --git a/package.json b/package.json index e3f988f7..f0f24748 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.17.1", + "version": "1.0.6", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ @@ -42,7 +42,6 @@ "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js", "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", "test-cov": "nyc npm test", - "test-travis": "nyc npm test -- --no-exit", - "version": "node scripts/version-history.js && git add HISTORY.md" + "test-travis": "nyc npm test -- --no-exit" } }