diff --git a/README.md b/README.md index b88ed824..ebc6fbce 100644 --- a/README.md +++ b/README.md @@ -462,6 +462,24 @@ called as `callback(error)` once the session has been set in the store. ### store.touch(sid, session, callback) +##### sessionid + +Function to manually set the sessionID. This is most helpful for environments where +cookies are not possible. When the expression returns no value, the regular sessionID +will be used or generated. + +**NOTE** be careful with unsecured connections. When you don't use SSL, a man in the +middle could intercept a sessionID and pick up a session from there. + +```js +app.use(session({ + sessionid: function(req) { + return req.query.sessionID; + }, + secret: 'keyboard cat' +})) +``` + **Recommended** This recommended method is used to "touch" a given session given a diff --git a/index.js b/index.js index 5794118f..10a30381 100644 --- a/index.js +++ b/index.js @@ -75,6 +75,7 @@ var defer = typeof setImmediate === 'function' * @param {Boolean} [options.proxy] * @param {Boolean} [options.resave] Resave unmodified sessions back to the store * @param {Boolean} [options.rolling] Enable/disable rolling session expiration + * @param {Function} [options.sessionid] Manually set session ID * @param {Boolean} [options.saveUninitialized] Save uninitialized sessions to the store * @param {String|Array} [options.secret] Secret for signing session ID * @param {Object} [options.store=MemoryStore] Session store @@ -97,7 +98,9 @@ function session(options) { // get the session store var store = opts.store || new MemoryStore() - + + var getManualSessionId = options.sessionid || function(req) {}; + // get the trust proxy setting var trustProxy = opts.proxy @@ -155,7 +158,7 @@ function session(options) { // generates the new session store.generate = function(req){ - req.sessionID = generateId(req); + req.sessionID = getManualSessionId(req) ? getManualSessionId(req) : generateId(req); req.session = new Session(req); req.session.cookie = new Cookie(cookieOptions); @@ -212,7 +215,7 @@ function session(options) { req.sessionStore = store; // get the session ID from the cookie - var cookieId = req.sessionID = getcookie(req, name, secrets); + var cookieId = req.sessionID = getManualSessionId(req) ? getManualSessionId(req) : getcookie(req, name, secrets) // set-cookie onHeaders(res, function(){