Fix issue where "resave: false" may not save altered sessions

Author: dougwilson

HISTORY.md

@@ -1,9 +1,9 @@
 unreleased
 ==========
 
+  * Fix issue where `resave: false` may not save altered sessions
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
-  * deps: crc@3.5.0
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
 

index.js

@@ -15,7 +15,7 @@
 
 var Buffer = require('safe-buffer').Buffer
 var cookie = require('cookie');
-var crc = require('crc').crc32;
+var crypto = require('crypto')
 var debug = require('debug')('express-session');
 var deprecate = require('depd')('express-session');
 var onHeaders = require('on-headers')
@@ -578,14 +578,21 @@ function getcookie(req, name, secrets) {
  */
 
 function hash(sess) {
-  return crc(JSON.stringify(sess, function (key, val) {
+  // serialize
+  var str = JSON.stringify(sess, function (key, val) {
     // ignore sess.cookie property
     if (this === sess && key === 'cookie') {
       return
     }
 
     return val
-  }))
+  })
+
+  // hash
+  return crypto
+    .createHash('sha1')
+    .update(str, 'utf8')
+    .digest('hex')
 }
 
 /**

package.json

@@ -12,7 +12,6 @@
   "dependencies": {
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "crc": "3.5.0",
     "debug": "2.6.9",
     "depd": "~1.1.2",
     "on-headers": "~1.0.1",

test/session.js

@@ -1038,22 +1038,37 @@ describe('session()', function(){
 
       it('should still save modified session', function (done) {
         var store = new session.MemoryStore()
-        var server = createServer({ store: store, resave: false }, function (req, res) {
-          req.session.count = req.session.count || 0
-          req.session.count++
-          res.end()
+        var server = createServer({ resave: false, store: store }, function (req, res) {
+          if (req.method === 'PUT') {
+            req.session.token = req.url.substr(1)
+          }
+          res.end('token=' + (req.session.token || ''))
         })
 
         request(server)
-        .get('/')
+        .put('/w6RHhwaA')
+        .expect(200)
         .expect(shouldSetSessionInStore(store))
-        .expect(200, function (err, res) {
+        .expect('token=w6RHhwaA')
+        .end(function (err, res) {
           if (err) return done(err)
+          var sess = cookie(res)
           request(server)
           .get('/')
-          .set('Cookie', cookie(res))
-          .expect(shouldSetSessionInStore(store))
-          .expect(200, done)
+          .set('Cookie', sess)
+          .expect(200)
+          .expect(shouldNotSetSessionInStore(store))
+          .expect('token=w6RHhwaA')
+          .end(function (err) {
+            if (err) return done(err)
+            request(server)
+            .put('/zfQ3rzM3')
+            .set('Cookie', sess)
+            .expect(200)
+            .expect(shouldSetSessionInStore(store))
+            .expect('token=zfQ3rzM3')
+            .end(done)
+          })
         })
       })