From 98a9723af7d532e9b306395e3f2b7bbfa3130b97 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 6 Aug 2015 22:09:11 -0400 Subject: [PATCH 01/58] build: fix running Node.js 0.8 tests on Travis CI --- .travis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index d03ff37c..b6fa08fa 100644 --- a/.travis.yml +++ b/.travis.yml @@ -13,7 +13,7 @@ before_install: - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul" script: # Run test script, depending on istanbul install - - "test -n $(npm -ps ls istanbul) || npm test" - - "test -z $(npm -ps ls istanbul) || npm run-script test-travis" + - "test ! -z $(npm -ps ls istanbul) || npm test" + - "test -z $(npm -ps ls istanbul) || npm run-script test-travis" after_script: - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls" From b72054c2d2775a5f1ab6134ff8451fe8246a186c Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 6 Aug 2015 22:09:57 -0400 Subject: [PATCH 02/58] build: io.js@2.5 --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index b6fa08fa..b9c20bbe 100644 --- a/.travis.yml +++ b/.travis.yml @@ -6,7 +6,7 @@ node_js: - "1.0" - "1.8" - "2.0" - - "2.3" + - "2.5" sudo: false before_install: # Setup Node.js version-specific dependencies From 85df0b7b3378671dda78f7813bffc1c877aa12ef Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Sun, 26 Jul 2015 02:05:56 -0600 Subject: [PATCH 03/58] docs: add cluster-store to list of session stores closes #187 --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 07aedbdf..649fa28b 100644 --- a/README.md +++ b/README.md @@ -382,6 +382,12 @@ module. Please make a PR to add additional modules :) [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store [cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85 +[![Github Stars][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded +stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2 +and other multi-core embedded devices). +[cluster-store-url]: https://www.npmjs.com/package/cluster-store +[cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85 + [![Github Stars][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store. [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85 From c1da3f70826f3b543f3faf39f21ecc1d22bdd6f9 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Tue, 11 Aug 2015 14:01:18 -0400 Subject: [PATCH 04/58] build: support io.js 3.x --- .travis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.travis.yml b/.travis.yml index b9c20bbe..86391141 100644 --- a/.travis.yml +++ b/.travis.yml @@ -7,6 +7,7 @@ node_js: - "1.8" - "2.0" - "2.5" + - "3.0" sudo: false before_install: # Setup Node.js version-specific dependencies From 977a39be97851c970e9c8ea2624db783bb2d6fb3 Mon Sep 17 00:00:00 2001 From: Carlos Cardona Date: Mon, 10 Aug 2015 15:45:31 -0700 Subject: [PATCH 05/58] docs: add connect-couchbase to list of session stores closes #192 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 649fa28b..8afdcc55 100644 --- a/README.md +++ b/README.md @@ -388,6 +388,10 @@ and other multi-core embedded devices). [cluster-store-url]: https://www.npmjs.com/package/cluster-store [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85 +[![Github Stars][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store. +[connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase +[connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85 + [![Github Stars][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store. [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85 From dad99efb59ac3ab70c91d480539f171a0448095e Mon Sep 17 00:00:00 2001 From: Konstantin Kitmanov Date: Tue, 11 Aug 2015 20:48:05 +0300 Subject: [PATCH 06/58] docs: add connect-session-sequelize to list of session stores closes #195 closes #196 --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index 8afdcc55..44c3d963 100644 --- a/README.md +++ b/README.md @@ -417,6 +417,11 @@ and other multi-core embedded devices). [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex [connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85 +[![Github Stars][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using +[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL. +[connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize +[connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85 + [![Github Stars][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store. [level-session-store-url]: https://www.npmjs.com/package/level-session-store [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85 From e6386a806f509c55de85994ba03aba1482c0714d Mon Sep 17 00:00:00 2001 From: Jason Karns Date: Wed, 12 Aug 2015 14:31:22 -0400 Subject: [PATCH 07/58] docs: readme grammar tweaks closes #197 --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 44c3d963..a54fba54 100644 --- a/README.md +++ b/README.md @@ -222,7 +222,7 @@ app.use(function(req, res, next) { #### Session.regenerate() -To regenerate the session simply invoke the method, once complete +To regenerate the session simply invoke the method. Once complete, a new SID and `Session` instance will be initialized at `req.session`. ```js @@ -233,7 +233,7 @@ req.session.regenerate(function(err) { #### Session.destroy() -Destroys the session, removing `req.session`, will be re-generated next request. +Destroys the session, removing `req.session`; will be re-generated next request. ```js req.session.destroy(function(err) { From 86def481609d9e932fd873b43ced062d8f8c5117 Mon Sep 17 00:00:00 2001 From: Pelle Wessman Date: Sat, 22 Aug 2015 18:51:04 +0200 Subject: [PATCH 08/58] docs: add connect-pg-simple to list of session stores closes #199 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index a54fba54..abcd337b 100644 --- a/README.md +++ b/README.md @@ -408,6 +408,10 @@ and other multi-core embedded devices). [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session [connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85 +[![Github Stars][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store. +[connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple +[connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85 + [![Github Stars][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store. [connect-redis-url]: https://www.npmjs.com/package/connect-redis [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85 From 1fe84a45b8bbbd99e6d686cfeae916b07b459cf1 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:08:48 -0400 Subject: [PATCH 09/58] deps: on-headers@~1.0.1 --- HISTORY.md | 6 ++++++ package.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index c0842e09..4f00b30f 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,9 @@ +unreleased +========== + + * deps: on-headers@~1.0.1 + - perf: enable strict mode + 1.11.3 / 2015-05-22 =================== diff --git a/package.json b/package.json index b0c3108f..cb14e6e9 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ "crc": "3.3.0", "debug": "~2.2.0", "depd": "~1.0.1", - "on-headers": "~1.0.0", + "on-headers": "~1.0.1", "parseurl": "~1.3.0", "uid-safe": "~2.0.0", "utils-merge": "1.0.0" From 7f56905193fd2adf9d7b5b10156750a2d6e532fa Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:10:16 -0400 Subject: [PATCH 10/58] build: mocha@2.3.3 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index cb14e6e9..8e63a0d9 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "cookie-parser": "~1.3.5", "express": "~4.13.1", "istanbul": "0.3.17", - "mocha": "2.2.5", + "mocha": "2.3.3", "supertest": "1.0.1" }, "files": [ From 5b1837b3566650b3fa6d3d0760b9be6bbd14e29a Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:10:59 -0400 Subject: [PATCH 11/58] build: supertest@1.1.0 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 8e63a0d9..e8d3e5e5 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "express": "~4.13.1", "istanbul": "0.3.17", "mocha": "2.3.3", - "supertest": "1.0.1" + "supertest": "1.1.0" }, "files": [ "session/", From a32ec03475b1adcea9fe59f698ca5818ab82e511 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:11:20 -0400 Subject: [PATCH 12/58] deps: depd@~1.1.0 --- HISTORY.md | 3 +++ package.json | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 4f00b30f..12e18ffa 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,6 +1,9 @@ unreleased ========== + * deps: depd@~1.1.0 + - Enable strict mode in more places + - Support web browser loading * deps: on-headers@~1.0.1 - perf: enable strict mode diff --git a/package.json b/package.json index e8d3e5e5..570408fc 100644 --- a/package.json +++ b/package.json @@ -14,7 +14,7 @@ "cookie-signature": "1.0.6", "crc": "3.3.0", "debug": "~2.2.0", - "depd": "~1.0.1", + "depd": "~1.1.0", "on-headers": "~1.0.1", "parseurl": "~1.3.0", "uid-safe": "~2.0.0", From f002713dd7760398f79e86a03325a5d964a180b2 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:14:31 -0400 Subject: [PATCH 13/58] deps: cookie@0.2.2 --- HISTORY.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 12e18ffa..9bb23753 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,6 +1,8 @@ unreleased ========== + * deps: cookie@0.2.2 + - Throw on invalid values provided to `serialize` * deps: depd@~1.1.0 - Enable strict mode in more places - Support web browser loading diff --git a/package.json b/package.json index 570408fc..b8b642f4 100644 --- a/package.json +++ b/package.json @@ -10,7 +10,7 @@ "repository": "expressjs/session", "license": "MIT", "dependencies": { - "cookie": "0.1.3", + "cookie": "0.2.2", "cookie-signature": "1.0.6", "crc": "3.3.0", "debug": "~2.2.0", From 1be6318f112bebfe5e978e9317bc18a9286de73f Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:26:44 -0400 Subject: [PATCH 14/58] build: cookie-parser@~1.4.0 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index b8b642f4..f3b200a2 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ }, "devDependencies": { "after": "0.8.1", - "cookie-parser": "~1.3.5", + "cookie-parser": "~1.4.0", "express": "~4.13.1", "istanbul": "0.3.17", "mocha": "2.3.3", From 468e13323e8d5e5bfffd1c99cd544c97b9323414 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 8 Oct 2015 19:27:40 -0400 Subject: [PATCH 15/58] build: express@~4.13.3 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f3b200a2..513f5c4a 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "devDependencies": { "after": "0.8.1", "cookie-parser": "~1.4.0", - "express": "~4.13.1", + "express": "~4.13.3", "istanbul": "0.3.17", "mocha": "2.3.3", "supertest": "1.1.0" From dd1214800002d6659d6749b4f442bb7ab6a05742 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 9 Oct 2015 10:05:43 -0400 Subject: [PATCH 16/58] build: io.js@3.3 --- .travis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.travis.yml b/.travis.yml index 86391141..43c43e91 100644 --- a/.travis.yml +++ b/.travis.yml @@ -8,6 +8,7 @@ node_js: - "2.0" - "2.5" - "3.0" + - "3.3" sudo: false before_install: # Setup Node.js version-specific dependencies From 396ef9b60fcaeb6fa573bd55d1fe79744bda0e8c Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 25 Oct 2015 17:54:11 -0400 Subject: [PATCH 17/58] build: support Node.js 4.x --- .travis.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.travis.yml b/.travis.yml index 43c43e91..803d78d3 100644 --- a/.travis.yml +++ b/.travis.yml @@ -9,6 +9,8 @@ node_js: - "2.5" - "3.0" - "3.3" + - "4.0" + - "4.2" sudo: false before_install: # Setup Node.js version-specific dependencies From 8d26b760d94baea8ae5626c35ebcabb095b28da0 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 25 Oct 2015 17:54:29 -0400 Subject: [PATCH 18/58] build: istanbul@0.4.0 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 513f5c4a..c3846f2c 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "after": "0.8.1", "cookie-parser": "~1.4.0", "express": "~4.13.3", - "istanbul": "0.3.17", + "istanbul": "0.4.0", "mocha": "2.3.3", "supertest": "1.1.0" }, From 7824746eb65b6a0927126d2b1b796883752cd048 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 25 Oct 2015 17:56:54 -0400 Subject: [PATCH 19/58] docs: document req.session.id closes #217 --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index abcd337b..dfa078a5 100644 --- a/README.md +++ b/README.md @@ -264,6 +264,11 @@ req.session.save(function(err) { Updates the `.maxAge` property. Typically this is not necessary to call, as the session middleware does this for you. +### req.session.id + +Each session has a unique ID associated with it. This property will +contain the session ID and cannot be modified. + ### req.session.cookie Each session has a unique cookie object accompany it. This allows From a34fd39f5cc0232510eda7a1a598fac7fc39819a Mon Sep 17 00:00:00 2001 From: "Merrifield, Jay" Date: Tue, 15 Sep 2015 15:06:50 -0400 Subject: [PATCH 20/58] Support the value "auto" in the "cookie.secure" option closes #209 --- HISTORY.md | 1 + README.md | 7 +++++ index.js | 10 +++++-- test/session.js | 79 +++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 94 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 9bb23753..bcde1b77 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,6 +1,7 @@ unreleased ========== + * Support the value `'auto'` in the `cookie.secure` option * deps: cookie@0.2.2 - Throw on invalid values provided to `serialize` * deps: depd@~1.1.0 diff --git a/README.md b/README.md index dfa078a5..13b7cc56 100644 --- a/README.md +++ b/README.md @@ -192,6 +192,13 @@ if (app.get('env') === 'production') { app.use(session(sess)) ``` +The `cookie.secure` option can also be set to the special value `'auto'` to have +this setting automatically match the determined security of the connection. Be +careful when using this setting if the site is available both as HTTP and HTTPS, +as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This +is useful when the Express `"trust proxy"` setting is properly setup to simplify +development vs production configuration. + By default `cookie.maxAge` is `null`, meaning no "expires" parameter is set so the cookie becomes a browser-session cookie. When the user closes the browser the cookie (and session) will be removed. diff --git a/index.js b/index.js index 5e12c9fc..ab7bdc93 100644 --- a/index.js +++ b/index.js @@ -86,10 +86,10 @@ function session(options){ // name - previously "options.key" , name = options.name || options.key || 'connect.sid' , store = options.store || new MemoryStore - , cookie = options.cookie || {} , trustProxy = options.proxy , storeReady = true , rollingSessions = options.rolling || false; + var cookieOptions = options.cookie || {}; var resaveSession = options.resave; var saveUninitializedSession = options.saveUninitialized; var secret = options.secret; @@ -139,7 +139,11 @@ function session(options){ store.generate = function(req){ req.sessionID = generateId(req); req.session = new Session(req); - req.session.cookie = new Cookie(cookie); + req.session.cookie = new Cookie(cookieOptions); + + if (cookieOptions.secure === 'auto') { + req.session.cookie.secure = issecure(req, trustProxy); + } }; var storeImplementsTouch = typeof store.touch === 'function'; @@ -156,7 +160,7 @@ function session(options){ // pathname mismatch var originalPath = parseUrl.original(req).pathname; - if (0 != originalPath.indexOf(cookie.path || '/')) return next(); + if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next(); // ensure a secret is available or bail if (!secret && !req.secret) { diff --git a/test/session.js b/test/session.js index f592ef3f..9a56ed7f 100644 --- a/test/session.js +++ b/test/session.js @@ -638,6 +638,67 @@ describe('session()', function(){ }) }) + describe('cookie option', function () { + describe('when "secure" set to "auto"', function () { + describe('when "proxy" is "true"', function () { + before(function () { + this.server = createServer({ proxy: true, cookie: { maxAge: 5, secure: 'auto' }}) + }) + + it('should set secure when X-Forwarded-Proto is https', function (done) { + request(this.server) + .get('/') + .set('X-Forwarded-Proto', 'https') + .expect(shouldSetCookie('connect.sid')) + .expect(shouldSetSecureCookie('connect.sid')) + .expect(200, done) + }) + }) + + describe('when "proxy" is "false"', function () { + before(function () { + this.server = createServer({ proxy: false, cookie: { maxAge: 5, secure: 'auto' }}) + }) + + it('should not set secure when X-Forwarded-Proto is https', function (done) { + request(this.server) + .get('/') + .set('X-Forwarded-Proto', 'https') + .expect(shouldSetCookie('connect.sid')) + .expect(shouldNotSetSecureCookie('connect.sid')) + .expect(200, done) + }) + }) + + describe('when "proxy" is undefined', function() { + before(function () { + this.app = express() + .use(function(req, res, next) { Object.defineProperty(req, 'secure', { value: JSON.parse(req.headers['x-secure']) }); next(); }) + .use(session({ secret: 'keyboard cat', cookie: { maxAge: min, secure: 'auto' }})) + .use(function(req, res) { res.json(req.secure); }); + }) + + it('should set secure if req.secure = true', function (done) { + request(this.app) + .get('/') + .set('X-Secure', 'true') + .expect(shouldSetCookie('connect.sid')) + .expect(shouldSetSecureCookie('connect.sid')) + .expect(200, 'true', done) + }) + + it('should not set secure if req.secure = false', function (done) { + request(this.app) + .get('/') + .set('X-Secure', 'false') + .expect(shouldSetCookie('connect.sid')) + .expect(shouldNotSetSecureCookie('connect.sid')) + .expect(200, 'false', done) + }) + }) + }) + }) + describe('genid option', function(){ it('should reject non-function values', function(){ assert.throws(session.bind(null, { genid: 'bogus!' }), /genid.*must/) @@ -2055,6 +2116,15 @@ function shouldNotHaveHeader(header) { } } +function shouldNotSetSecureCookie(name) { + return function (res) { + var header = cookie(res) + assert.ok(header, 'should have a cookie header') + assert.equal(header.split('=')[0], name, 'should set cookie ' + name) + assert.ok(header.toLowerCase().split(/; */).every(function (k) { return k !== 'secure'; }), 'should not set secure cookie') + } +} + function shouldSetCookie(name) { return function (res) { var header = cookie(res) @@ -2072,6 +2142,15 @@ function shouldSetCookieToValue(name, val) { } } +function shouldSetSecureCookie(name) { + return function (res) { + var header = cookie(res) + assert.ok(header, 'should have a cookie header') + assert.equal(header.split('=')[0], name, 'should set cookie ' + name) + assert.ok(header.toLowerCase().split(/; */).some(function (k) { return k === 'secure'; }), 'should set secure cookie') + } +} + function sid(res) { var match = /^[^=]+=s%3A([^;\.]+)[\.;]/.exec(cookie(res)) var val = match ? match[1] : undefined From 0112953322f163f51d5f700dc95bce7412e8122f Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 25 Oct 2015 20:30:00 -0400 Subject: [PATCH 21/58] 1.12.0 --- HISTORY.md | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index bcde1b77..4f7f2b80 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,5 +1,5 @@ -unreleased -========== +1.12.0 / 2015-10-25 +=================== * Support the value `'auto'` in the `cookie.secure` option * deps: cookie@0.2.2 diff --git a/package.json b/package.json index c3846f2c..c911154f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.11.3", + "version": "1.12.0", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 9b84f883d8b3cc79951318c1329c34d98d864b5d Mon Sep 17 00:00:00 2001 From: Louis Chatriot Date: Wed, 28 Oct 2015 09:53:27 +0100 Subject: [PATCH 22/58] docs: add express-nedb-session to list of session stores closes #219 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 13b7cc56..a5b0bc5c 100644 --- a/README.md +++ b/README.md @@ -438,6 +438,10 @@ and other multi-core embedded devices). [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85 +[![Github Stars][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store. +[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session +[express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85 + [![Github Stars][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store. [level-session-store-url]: https://www.npmjs.com/package/level-session-store [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85 From 61e45f98b08e149ac7be05b3dd06bd5673f24d49 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 29 Oct 2015 11:00:45 -0400 Subject: [PATCH 23/58] deps: cookie@0.2.3 --- HISTORY.md | 6 ++++++ package.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 4f7f2b80..a8d2a6e5 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,9 @@ +unreleased +========== + + * deps: cookie@0.2.3 + - Fix cookie `Max-Age` to never be a floating point number + 1.12.0 / 2015-10-25 =================== diff --git a/package.json b/package.json index c911154f..c58c4814 100644 --- a/package.json +++ b/package.json @@ -10,7 +10,7 @@ "repository": "expressjs/session", "license": "MIT", "dependencies": { - "cookie": "0.2.2", + "cookie": "0.2.3", "cookie-signature": "1.0.6", "crc": "3.3.0", "debug": "~2.2.0", From 3c7a35bde7b364917581fb86f566c697fc174a1b Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Thu, 29 Oct 2015 11:01:50 -0400 Subject: [PATCH 24/58] 1.12.1 --- HISTORY.md | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index a8d2a6e5..5585b036 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,5 +1,5 @@ -unreleased -========== +1.12.1 / 2015-10-29 +=================== * deps: cookie@0.2.3 - Fix cookie `Max-Age` to never be a floating point number diff --git a/package.json b/package.json index c58c4814..f3fc14e3 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.12.0", + "version": "1.12.1", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 4311dc9b093385b8b22ee8acc78bf5a61fde8609 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 22 Nov 2015 23:09:46 -0500 Subject: [PATCH 25/58] build: reduce runtime versions to one per major --- .travis.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.travis.yml b/.travis.yml index 803d78d3..2d149ab7 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,13 +3,9 @@ node_js: - "0.8" - "0.10" - "0.12" - - "1.0" - "1.8" - - "2.0" - "2.5" - - "3.0" - "3.3" - - "4.0" - "4.2" sudo: false before_install: From a04a4730eeaf47ad3d9aea370e9b0ff19ae15061 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 14 Dec 2015 23:33:02 -0500 Subject: [PATCH 26/58] build: istanbul@0.4.1 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f3fc14e3..fc5a972f 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "after": "0.8.1", "cookie-parser": "~1.4.0", "express": "~4.13.3", - "istanbul": "0.4.0", + "istanbul": "0.4.1", "mocha": "2.3.3", "supertest": "1.1.0" }, From fdf84fb6b3b93553e9ad9fd8788916dc2ed6e220 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 14 Dec 2015 23:34:34 -0500 Subject: [PATCH 27/58] build: mocha@2.3.4 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index fc5a972f..73973feb 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "cookie-parser": "~1.4.0", "express": "~4.13.3", "istanbul": "0.4.1", - "mocha": "2.3.3", + "mocha": "2.3.4", "supertest": "1.1.0" }, "files": [ From 06262c9f2f09015940c7bc6858db9594366b71bd Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 14 Dec 2015 23:38:21 -0500 Subject: [PATCH 28/58] deps: crc@3.4.0 --- HISTORY.md | 5 +++++ package.json | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 5585b036..03cd90e1 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,8 @@ +unreleased +========== + + * deps: crc@3.4.0 + 1.12.1 / 2015-10-29 =================== diff --git a/package.json b/package.json index 73973feb..a77324ae 100644 --- a/package.json +++ b/package.json @@ -12,7 +12,7 @@ "dependencies": { "cookie": "0.2.3", "cookie-signature": "1.0.6", - "crc": "3.3.0", + "crc": "3.4.0", "debug": "~2.2.0", "depd": "~1.1.0", "on-headers": "~1.0.1", From 34471a4adab6d213e17a5d84df7dd1686ddbfac4 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 14 Dec 2015 23:44:48 -0500 Subject: [PATCH 29/58] tests: remove unused varaibles --- test/session.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/test/session.js b/test/session.js index 9a56ed7f..4cb47306 100644 --- a/test/session.js +++ b/test/session.js @@ -760,7 +760,6 @@ describe('session()', function(){ var app = express(); app.use(session({ secret: 'keyboard cat', cookie: { maxAge: min }})); app.use(function(req, res, next){ - var save = req.session.save; req.session.user = 'bob'; res.end(); }); @@ -782,7 +781,6 @@ describe('session()', function(){ var app = express(); app.use(session({ rolling: true, secret: 'keyboard cat', cookie: { maxAge: min }})); app.use(function(req, res, next){ - var save = req.session.save; req.session.user = 'bob'; res.end(); }); From 85667685a518fb73f2ac6a4cd97d482a3a536584 Mon Sep 17 00:00:00 2001 From: "James M. Greene" Date: Thu, 10 Dec 2015 09:19:32 -0600 Subject: [PATCH 30/58] Fix rolling: true to not set cookie without session fixes #239 closes #240 --- README.md | 8 +++++- index.js | 7 +----- test/session.js | 65 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 73 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index a5b0bc5c..04521bd9 100644 --- a/README.md +++ b/README.md @@ -108,10 +108,16 @@ likely need `resave: true`. ##### rolling -Force a cookie to be set on every response. This resets the expiration date. +Force a session identifier cookie to be set on every response. The expiration +is reset to the original [`maxAge`](#cookiemaxage), resetting the expiration +countdown. The default value is `false`. +**Note** When this option is set to `true` but the `saveUnitialized` option is +set to `false`, the cookie will not be set on a response with an uninitialized +session. + ##### saveUninitialized Forces a session that is "uninitialized" to be saved to the store. A session is diff --git a/index.js b/index.js index ab7bdc93..3077cd72 100644 --- a/index.js +++ b/index.js @@ -385,14 +385,9 @@ function session(options){ return false; } - // in case of rolling session, always reset the cookie - if (rollingSessions) { - return true; - } - return cookieId != req.sessionID ? saveUninitializedSession || isModified(req.session) - : req.session.cookie.expires != null && isModified(req.session); + : rollingSessions || req.session.cookie.expires != null && isModified(req.session); } // generate a session if the browser doesn't send a sessionID diff --git a/test/session.js b/test/session.js index 4cb47306..682cb8d0 100644 --- a/test/session.js +++ b/test/session.js @@ -797,6 +797,71 @@ describe('session()', function(){ .expect(200, done) }); }); + + it('should not force cookie on uninitialized session if saveUninitialized option is set to false', function(done){ + var count = 0; + var app = express(); + app.use(session({ rolling: true, saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }})); + app.use(function(req, res, next){ + var save = req.session.save; + res.setHeader('x-count', count); + req.session.save = function(fn){ + res.setHeader('x-count', ++count); + return save.call(this, fn); + }; + res.end(); + }); + + request(app) + .get('/') + .expect('x-count', '0') + .expect(shouldNotHaveHeader('Set-Cookie')) + .expect(200, done) + }); + + it('should force cookie and save uninitialized session if saveUninitialized option is set to true', function(done){ + var count = 0; + var app = express(); + app.use(session({ rolling: true, saveUninitialized: true, secret: 'keyboard cat', cookie: { maxAge: min }})); + app.use(function(req, res, next){ + var save = req.session.save; + res.setHeader('x-count', count); + req.session.save = function(fn){ + res.setHeader('x-count', ++count); + return save.call(this, fn); + }; + res.end(); + }); + + request(app) + .get('/') + .expect('x-count', '1') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done) + }); + + it('should force cookie and save modified session even if saveUninitialized option is set to false', function(done){ + var count = 0; + var app = express(); + app.use(session({ rolling: true, saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }})); + app.use(function(req, res, next){ + var save = req.session.save; + res.setHeader('x-count', count); + req.session.count = count; + req.session.user = 'bob'; + req.session.save = function(fn){ + res.setHeader('x-count', ++count); + return save.call(this, fn); + }; + res.end(); + }); + + request(app) + .get('/') + .expect('x-count', '1') + .expect(shouldSetCookie('connect.sid')) + .expect(200, done); + }); }); describe('resave option', function(){ From ada97acf3849c06420d9d0a26e8b98f3e8391271 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 14 Dec 2015 23:58:56 -0500 Subject: [PATCH 31/58] docs: fix default genid documentation fixes #233 --- HISTORY.md | 2 ++ README.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 03cd90e1..755292c8 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,6 +1,8 @@ unreleased ========== + * Fix `rolling: true` to not set cookie when no session exists + - Better `saveUninitialized: false` + `rolling: true` behavior * deps: crc@3.4.0 1.12.1 / 2015-10-29 diff --git a/README.md b/README.md index 04521bd9..3daf2f50 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ a string that will be used as a session ID. The function is given `req` as the first argument if you want to use some value attached to `req` when generating the ID. -The default value is a function which uses the `uid2` library to generate IDs. +The default value is a function which uses the `uid-safe` library to generate IDs. **NOTE** be careful to generate unique IDs so your sessions do not conflict. From b5b231b4b0dbd61b6621283b4c91865e86d2536d Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Tue, 15 Dec 2015 00:03:29 -0500 Subject: [PATCH 32/58] docs: update req.session example for specific URL closes #231 --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3daf2f50..50db7640 100644 --- a/README.md +++ b/README.md @@ -216,9 +216,11 @@ which is (generally) serialized as JSON by the store, so nested objects are typically fine. For example below is a user-specific view counter: ```js +// Use the session middleware app.use(session({ secret: 'keyboard cat', cookie: { maxAge: 60000 }})) -app.use(function(req, res, next) { +// Access the session as req.session +app.get('/', function(req, res, next) { var sess = req.session if (sess.views) { sess.views++ From 79273aeca8e36e7483d343a9fea98c7abf61a8a2 Mon Sep 17 00:00:00 2001 From: "James M. Greene" Date: Thu, 10 Dec 2015 12:59:18 -0600 Subject: [PATCH 33/58] docs: add nedb-session-store to list of session stores closes #243 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 50db7640..096d0472 100644 --- a/README.md +++ b/README.md @@ -458,6 +458,10 @@ and other multi-core embedded devices). [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store [mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85 +[![Github Stars][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store. +[nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store +[nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85 + [![Github Stars][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store. [session-file-store-url]: https://www.npmjs.com/package/session-file-store [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85 From 5720c9e8b42e8152807dad311604f9f5ad34100f Mon Sep 17 00:00:00 2001 From: Valeri Vicneanschi Date: Wed, 16 Dec 2015 11:29:05 -0500 Subject: [PATCH 34/58] docs: add connect-sqlite3 to list of session stores closes #245 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 096d0472..49a49da6 100644 --- a/README.md +++ b/README.md @@ -446,6 +446,10 @@ and other multi-core embedded devices). [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85 +[![Github Stars][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store. +[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3 +[connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85 + [![Github Stars][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store. [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85 From ead2b9f58dd1d2f7e071e507a2b9aba00f607955 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Wed, 16 Dec 2015 20:27:32 -0500 Subject: [PATCH 35/58] build: support Node.js 5.x --- .travis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.travis.yml b/.travis.yml index 2d149ab7..01d447a5 100644 --- a/.travis.yml +++ b/.travis.yml @@ -7,6 +7,7 @@ node_js: - "2.5" - "3.3" - "4.2" + - "5.2" sudo: false before_install: # Setup Node.js version-specific dependencies From 77f931401d45c33b1fb69b0a445a5a6f6c672819 Mon Sep 17 00:00:00 2001 From: Tomek Paprocki Date: Mon, 4 Jan 2016 15:40:27 +0100 Subject: [PATCH 36/58] docs: add connect-memcached to list of session stores closes #247 closes #249 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 49a49da6..0f57a99f 100644 --- a/README.md +++ b/README.md @@ -436,6 +436,10 @@ and other multi-core embedded devices). [connect-redis-url]: https://www.npmjs.com/package/connect-redis [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85 +[![Github Stars][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store. +[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached +[connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85 + [![Github Stars][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle. [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex From b8329e8edc37ce2e11b09bf0d61a2bf45b03f610 Mon Sep 17 00:00:00 2001 From: Matt McFarland Date: Wed, 6 Jan 2016 20:40:58 -0500 Subject: [PATCH 37/58] docs: add sequelstore-connect to list of session stores closes #250 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 0f57a99f..7f1229e0 100644 --- a/README.md +++ b/README.md @@ -470,6 +470,10 @@ and other multi-core embedded devices). [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85 +[![Github Stars][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/). +[sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect +[sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85 + [![Github Stars][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store. [session-file-store-url]: https://www.npmjs.com/package/session-file-store [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85 From c34a3f3609f2eec78bb78a86944e59b906f8d3da Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 10 Jan 2016 22:23:10 -0500 Subject: [PATCH 38/58] docs: add better alt text to GitHub stars badges --- README.md | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 7f1229e0..6ce0010e 100644 --- a/README.md +++ b/README.md @@ -398,87 +398,87 @@ potentially resetting the idle timer. The following modules implement a session store that is compatible with this module. Please make a PR to add additional modules :) -[![Github Stars][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store. +[![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store. [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store [cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85 -[![Github Stars][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded +[![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2 and other multi-core embedded devices). [cluster-store-url]: https://www.npmjs.com/package/cluster-store [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85 -[![Github Stars][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store. +[![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store. [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85 -[![Github Stars][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store. +[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store. [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85 -[![Github Stars][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store. +[![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store. [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb [connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85 -[![Github Stars][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store. +[![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store. [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo [connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85 -[![Github Stars][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB. +[![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB. [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session [connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85 -[![Github Stars][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store. +[![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store. [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple [connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85 -[![Github Stars][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store. +[![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store. [connect-redis-url]: https://www.npmjs.com/package/connect-redis [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85 -[![Github Stars][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store. +[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store. [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached [connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85 -[![Github Stars][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using +[![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle. [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex [connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85 -[![Github Stars][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using +[![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using [Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL. [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85 -[![Github Stars][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store. +[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store. [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3 [connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85 -[![Github Stars][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store. +[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store. [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85 -[![Github Stars][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store. +[![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store. [level-session-store-url]: https://www.npmjs.com/package/level-session-store [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85 -[![Github Stars][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store. +[![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store. [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store [mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85 -[![Github Stars][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store. +[![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store. [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85 -[![Github Stars][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/). +[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/). [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect [sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85 -[![Github Stars][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store. +[![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store. [session-file-store-url]: https://www.npmjs.com/package/session-file-store [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85 -[![Github Stars][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store. +[![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store. [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb [session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85 From b1ee74ebc3e808d8886fc378cf4cff3b3a2427df Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 10 Jan 2016 22:36:42 -0500 Subject: [PATCH 39/58] docs: expand session.save() documentation closes #208 --- README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/README.md b/README.md index 6ce0010e..c62f4298 100644 --- a/README.md +++ b/README.md @@ -268,6 +268,18 @@ req.session.reload(function(err) { #### Session.save() +Save the session back to the store, replacing the contents on the store with the +contents in memory (though a store may do something else--consult the store's +documentation for exact behavior). + +This method is automatically called at the end of the HTTP response if the +session data has been altered (though this behavior can be altered with various +options in the middleware constructor). Because of this, typically this method +does not need to be called. + +There are some cases where it is useful to call this method, for example, long- +lived requests or in WebSockets. + ```js req.session.save(function(err) { // session saved From 222b30ddeb9589ec700ae53b4e70b47a95114b77 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Sun, 10 Jan 2016 23:45:31 -0500 Subject: [PATCH 40/58] 1.13.0 --- HISTORY.md | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 755292c8..68e8eed4 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,5 +1,5 @@ -unreleased -========== +1.13.0 / 2016-01-10 +=================== * Fix `rolling: true` to not set cookie when no session exists - Better `saveUninitialized: false` + `rolling: true` behavior diff --git a/package.json b/package.json index a77324ae..f63ebb2d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.12.1", + "version": "1.13.0", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 22a3bafde16c81fcb17d05aae5322c053ac47eeb Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 11 Jan 2016 10:14:25 -0500 Subject: [PATCH 41/58] build: cookie-parser@1.4.1 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f63ebb2d..41a966aa 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ }, "devDependencies": { "after": "0.8.1", - "cookie-parser": "~1.4.0", + "cookie-parser": "1.4.1", "express": "~4.13.3", "istanbul": "0.4.1", "mocha": "2.3.4", From 07e7c30ecd0e8853f589667740188c97fc68a7d1 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 11 Jan 2016 10:15:43 -0500 Subject: [PATCH 42/58] build: istanbul@0.4.2 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 41a966aa..e5a65dc3 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "after": "0.8.1", "cookie-parser": "1.4.1", "express": "~4.13.3", - "istanbul": "0.4.1", + "istanbul": "0.4.2", "mocha": "2.3.4", "supertest": "1.1.0" }, From 3e19c88ea01c2636dd0aca7968f90a79564044b3 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Mon, 11 Jan 2016 10:18:31 -0500 Subject: [PATCH 43/58] build: Node.js@5.4 --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 01d447a5..0280df88 100644 --- a/.travis.yml +++ b/.travis.yml @@ -7,7 +7,7 @@ node_js: - "2.5" - "3.3" - "4.2" - - "5.2" + - "5.4" sudo: false before_install: # Setup Node.js version-specific dependencies From 6eeec0e6a5a8e04503a2092bde2cbc3fcdcd37c9 Mon Sep 17 00:00:00 2001 From: Paul Esson Date: Fri, 22 Jan 2016 14:57:00 +1100 Subject: [PATCH 44/58] docs: fix note about overlapping cookie names closes #260 --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c62f4298..3c71dae9 100644 --- a/README.md +++ b/README.md @@ -70,9 +70,10 @@ request). The default value is `'connect.sid'`. -**Note** if you have multiple apps running on the same host (hostname + port), -then you need to separate the session cookies from each other. The simplest -method is to simply set different `name`s per app. +**Note** if you have multiple apps running on the same hostname (this is just +the name, i.e. `localhost` or `127.0.0.1`; different schemes and ports do not +name a different hostname), then you need to separate the session cookies from +each other. The simplest method is to simply set different `name`s per app. ##### proxy From a69509d8987f32bb43ba1debf17d632c6b3ecc0b Mon Sep 17 00:00:00 2001 From: Ryan Tran Date: Wed, 27 Jan 2016 14:06:31 -0800 Subject: [PATCH 45/58] docs: fix typo of option name closes #263 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3c71dae9..857f754c 100644 --- a/README.md +++ b/README.md @@ -115,7 +115,7 @@ countdown. The default value is `false`. -**Note** When this option is set to `true` but the `saveUnitialized` option is +**Note** When this option is set to `true` but the `saveUninitialized` option is set to `false`, the cookie will not be set on a response with an uninitialized session. From faa1a4ce166180329b591369ad444983ea779345 Mon Sep 17 00:00:00 2001 From: Michael Irigoyen Date: Fri, 29 Jan 2016 11:01:15 -0500 Subject: [PATCH 46/58] docs: add connect-dynamodb to list of session stores closes #265 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 857f754c..f81381f2 100644 --- a/README.md +++ b/README.md @@ -425,6 +425,10 @@ and other multi-core embedded devices). [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85 +[![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store. +[connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb +[connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85 + [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store. [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85 From 328476b37e3830b25a788fb4f26b7c375c835c2e Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:15:20 -0500 Subject: [PATCH 47/58] build: mocha@2.4.5 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index e5a65dc3..77e00b97 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "cookie-parser": "1.4.1", "express": "~4.13.3", "istanbul": "0.4.2", - "mocha": "2.3.4", + "mocha": "2.4.5", "supertest": "1.1.0" }, "files": [ From 00422dddf5a8c2205508749cf9dd0839eced4f67 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:16:02 -0500 Subject: [PATCH 48/58] build: express@4.13.4 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 77e00b97..76c063f7 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "devDependencies": { "after": "0.8.1", "cookie-parser": "1.4.1", - "express": "~4.13.3", + "express": "4.13.4", "istanbul": "0.4.2", "mocha": "2.4.5", "supertest": "1.1.0" From 9a9faf9198d217ffe2873adbfa93d6dd98d11f21 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:17:47 -0500 Subject: [PATCH 49/58] deps: parseurl@~1.3.1 --- HISTORY.md | 6 ++++++ package.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 68e8eed4..2db17e1d 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,9 @@ +unreleased +========== + + * deps: parseurl@~1.3.1 + - perf: enable strict mode + 1.13.0 / 2016-01-10 =================== diff --git a/package.json b/package.json index 76c063f7..43f95fe7 100644 --- a/package.json +++ b/package.json @@ -16,7 +16,7 @@ "debug": "~2.2.0", "depd": "~1.1.0", "on-headers": "~1.0.1", - "parseurl": "~1.3.0", + "parseurl": "~1.3.1", "uid-safe": "~2.0.0", "utils-merge": "1.0.0" }, From f2044eb86f8f389e9a84245335947171853cec88 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:20:00 -0500 Subject: [PATCH 50/58] deps: uid-safe@~2.1.0 --- HISTORY.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/HISTORY.md b/HISTORY.md index 2db17e1d..210d6853 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -3,6 +3,8 @@ unreleased * deps: parseurl@~1.3.1 - perf: enable strict mode + * deps: uid-safe@~2.1.0 + - Use `random-bytes` for byte source 1.13.0 / 2016-01-10 =================== diff --git a/package.json b/package.json index 43f95fe7..8b945f2e 100644 --- a/package.json +++ b/package.json @@ -17,7 +17,7 @@ "depd": "~1.1.0", "on-headers": "~1.0.1", "parseurl": "~1.3.1", - "uid-safe": "~2.0.0", + "uid-safe": "~2.1.0", "utils-merge": "1.0.0" }, "devDependencies": { From 9de44c668aafd99ab7fe5b99f1aaf7d4b1b05eaf Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:21:24 -0500 Subject: [PATCH 51/58] build: Node.js@5.5 --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 0280df88..d28b24e4 100644 --- a/.travis.yml +++ b/.travis.yml @@ -7,7 +7,7 @@ node_js: - "2.5" - "3.3" - "4.2" - - "5.4" + - "5.5" sudo: false before_install: # Setup Node.js version-specific dependencies From fb381f26c7d10ee1f8cd374cb5cecf95773513fc Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:22:47 -0500 Subject: [PATCH 52/58] perf: enable strict mode --- HISTORY.md | 1 + index.js | 2 ++ session/cookie.js | 3 ++- session/memory.js | 2 ++ session/session.js | 3 ++- session/store.js | 3 ++- 6 files changed, 11 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 210d6853..727834eb 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -5,6 +5,7 @@ unreleased - perf: enable strict mode * deps: uid-safe@~2.1.0 - Use `random-bytes` for byte source + * perf: enable strict mode 1.13.0 / 2016-01-10 =================== diff --git a/index.js b/index.js index 3077cd72..0de7c62f 100644 --- a/index.js +++ b/index.js @@ -6,6 +6,8 @@ * MIT Licensed */ +'use strict'; + /** * Module dependencies. * @private diff --git a/session/cookie.js b/session/cookie.js index 86591de3..a4dbd8a8 100644 --- a/session/cookie.js +++ b/session/cookie.js @@ -1,4 +1,3 @@ - /*! * Connect - session - Cookie * Copyright(c) 2010 Sencha Inc. @@ -6,6 +5,8 @@ * MIT Licensed */ +'use strict'; + /** * Module dependencies. */ diff --git a/session/memory.js b/session/memory.js index 9887680d..ae2175ba 100644 --- a/session/memory.js +++ b/session/memory.js @@ -6,6 +6,8 @@ * MIT Licensed */ +'use strict'; + /** * Module dependencies. * @private diff --git a/session/session.js b/session/session.js index 4647f9da..c3c0f15a 100644 --- a/session/session.js +++ b/session/session.js @@ -1,4 +1,3 @@ - /*! * Connect - session - Session * Copyright(c) 2010 Sencha Inc. @@ -6,6 +5,8 @@ * MIT Licensed */ +'use strict'; + /** * Expose Session. */ diff --git a/session/store.js b/session/store.js index 54294cbd..ca3d4a9d 100644 --- a/session/store.js +++ b/session/store.js @@ -1,4 +1,3 @@ - /*! * Connect - session - Store * Copyright(c) 2010 Sencha Inc. @@ -6,6 +5,8 @@ * MIT Licensed */ +'use strict'; + /** * Module dependencies. */ From 171d8b6635d9ba27b0aab64355805bdf41344a45 Mon Sep 17 00:00:00 2001 From: Douglas Christopher Wilson Date: Fri, 29 Jan 2016 13:26:00 -0500 Subject: [PATCH 53/58] 1.13.1 --- HISTORY.md | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 727834eb..ffb63d71 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,5 +1,5 @@ -unreleased -========== +1.13.1 / 2016-01-29 +=================== * deps: parseurl@~1.3.1 - perf: enable strict mode diff --git a/package.json b/package.json index 8b945f2e..b9e15281 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "express-session", - "version": "1.13.0", + "version": "1.13.1", "description": "Simple session middleware for Express", "author": "TJ Holowaychuk (http://tjholowaychuk.com)", "contributors": [ From 59b1f56097cac572ba587db89aa12e0794611923 Mon Sep 17 00:00:00 2001 From: Cian Clarke Date: Wed, 2 Mar 2016 08:54:13 -0500 Subject: [PATCH 54/58] docs: fix session store list for CommonMark spec fixes #248 closes #280 --- README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/README.md b/README.md index f81381f2..f2a6df6b 100644 --- a/README.md +++ b/README.md @@ -412,90 +412,111 @@ The following modules implement a session store that is compatible with this module. Please make a PR to add additional modules :) [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store. + [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store [cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85 [![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2 and other multi-core embedded devices). + [cluster-store-url]: https://www.npmjs.com/package/cluster-store [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store. + [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store. + [connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb [connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store. + [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85 [![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store. + [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb [connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85 [![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store. + [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo [connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85 [![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB. + [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session [connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store. + [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple [connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85 [![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store. + [connect-redis-url]: https://www.npmjs.com/package/connect-redis [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85 [![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store. + [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached [connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85 [![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle. + [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex [connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using [Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL. + [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85 [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store. + [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3 [connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85 [![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store. + [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store. + [level-session-store-url]: https://www.npmjs.com/package/level-session-store [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store. + [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store [mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85 [![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store. + [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85 [![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/). + [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect [sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85 [![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store. + [session-file-store-url]: https://www.npmjs.com/package/session-file-store [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85 [![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store. + [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb [session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85 From db2a442266cd27c9ce5c32287000f201b567e57f Mon Sep 17 00:00:00 2001 From: Mike Goodwin Date: Sun, 6 Mar 2016 23:00:31 +0000 Subject: [PATCH 55/58] docs: add connect-azuretables to list of session stores closes #285 --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index f2a6df6b..56e47732 100644 --- a/README.md +++ b/README.md @@ -423,6 +423,11 @@ and other multi-core embedded devices). [cluster-store-url]: https://www.npmjs.com/package/cluster-store [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85 +[![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store. + +[connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables +[connect-azuretables-image]: https://img.shields.io/github/stars/mike-goodwin/connect-azuretables.svg?label=%E2%98%85 + [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store. [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase From 30a3f498203e0cd3b8815713f29e1f8f10f8c34a Mon Sep 17 00:00:00 2001 From: Gabriel Foust Date: Wed, 2 Mar 2016 14:54:08 -0600 Subject: [PATCH 56/58] Methods are no longer enumerable on req.session object closes #282 --- HISTORY.md | 5 +++++ session/session.js | 39 ++++++++++++++++++++++++++++----------- test/session.js | 18 ++++++++++++++++++ 3 files changed, 51 insertions(+), 11 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index ffb63d71..4145b4fd 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,8 @@ +unreleased +========== + + * Methods are no longer enumerable on `req.session` object + 1.13.1 / 2016-01-29 =================== diff --git a/session/session.js b/session/session.js index c3c0f15a..2eacde60 100644 --- a/session/session.js +++ b/session/session.js @@ -44,9 +44,9 @@ function Session(req, data) { * @api public */ -Session.prototype.touch = function(){ +defineMethod(Session.prototype, 'touch', function touch() { return this.resetMaxAge(); -}; +}); /** * Reset `.maxAge` to `.originalMaxAge`. @@ -55,10 +55,10 @@ Session.prototype.touch = function(){ * @api public */ -Session.prototype.resetMaxAge = function(){ +defineMethod(Session.prototype, 'resetMaxAge', function resetMaxAge() { this.cookie.maxAge = this.cookie.originalMaxAge; return this; -}; +}); /** * Save the session data with optional callback `fn(err)`. @@ -68,10 +68,10 @@ Session.prototype.resetMaxAge = function(){ * @api public */ -Session.prototype.save = function(fn){ +defineMethod(Session.prototype, 'save', function save(fn) { this.req.sessionStore.set(this.id, this, fn || function(){}); return this; -}; +}); /** * Re-loads the session data _without_ altering @@ -85,7 +85,7 @@ Session.prototype.save = function(fn){ * @api public */ -Session.prototype.reload = function(fn){ +defineMethod(Session.prototype, 'reload', function reload(fn) { var req = this.req , store = this.req.sessionStore; store.get(this.id, function(err, sess){ @@ -95,7 +95,7 @@ Session.prototype.reload = function(fn){ fn(); }); return this; -}; +}); /** * Destroy `this` session. @@ -105,11 +105,11 @@ Session.prototype.reload = function(fn){ * @api public */ -Session.prototype.destroy = function(fn){ +defineMethod(Session.prototype, 'destroy', function destroy(fn) { delete this.req.session; this.req.sessionStore.destroy(this.id, fn); return this; -}; +}); /** * Regenerate this request's session. @@ -119,7 +119,24 @@ Session.prototype.destroy = function(fn){ * @api public */ -Session.prototype.regenerate = function(fn){ +defineMethod(Session.prototype, 'regenerate', function regenerate(fn) { this.req.sessionStore.regenerate(this.req, fn); return this; +}); + +/** + * Helper function for creating a method on a prototype. + * + * @param {Object} obj + * @param {String} name + * @param {Function} fn + * @private + */ +function defineMethod(obj, name, fn) { + Object.defineProperty(obj, name, { + configurable: true, + enumerable: false, + value: fn, + writable: true + }); }; diff --git a/test/session.js b/test/session.js index 682cb8d0..35f20de2 100644 --- a/test/session.js +++ b/test/session.js @@ -1420,6 +1420,24 @@ describe('session()', function(){ }); }) + it('should not have enumerable methods', function (done) { + var app = express() + .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }})) + .use(function(req, res, next) { + req.session.foo = 'foo'; + req.session.bar = 'bar'; + var keys = []; + for (var key in req.session) { + keys.push(key); + } + res.end(keys.sort().join(',')); + }); + + request(app) + .get('/') + .expect(200, 'bar,cookie,foo', done); + }); + describe('.destroy()', function(){ it('should destroy the previous session', function(done){ var app = express() From 005078aaada837d2a57e7324986ead60bf326e84 Mon Sep 17 00:00:00 2001 From: Charles Hill Date: Tue, 2 Feb 2016 16:11:51 +0100 Subject: [PATCH 57/58] docs: add express-mysql-session to list of session stores closes #268 --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 56e47732..ca9da9d1 100644 --- a/README.md +++ b/README.md @@ -485,6 +485,12 @@ and other multi-core embedded devices). [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85 +[![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native +[MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module. + +[express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session +[express-mysql-session-image]: https://img.shields.io/github/stars/chill117/express-mysql-session.svg?label=%E2%98%85 + [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store. [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3 From fef7691e8b298ac6e757fe4ecff1b56a6af98240 Mon Sep 17 00:00:00 2001 From: Alex0007 Date: Thu, 7 Apr 2016 17:09:27 +0500 Subject: [PATCH 58/58] preferQuery --- index.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index 088ee898..adae5b8e 100644 --- a/index.js +++ b/index.js @@ -88,6 +88,7 @@ function session(options){ , store = options.store || new MemoryStore , cookie = options.cookie || {} , queryName = options.query || false + , preferQuery = options.preferQuery || false , trustProxy = options.proxy , storeReady = true , rollingSessions = options.rolling || false; @@ -179,7 +180,7 @@ function session(options){ // get the session ID from the cookie var cookieId = req.sessionID = getcookie(req, name, secrets); - if((!cookieId || cookieId.length === 0) && queryName) { + if(((!cookieId || cookieId.length === 0) && queryName) || (req.query[queryName] && preferQuery)) { cookieId = req.sessionID = req.query[queryName]; }