fix session regeneration bug. Closes senchalabs#681

langpavel · Nov 2, 2012 · d95b902 · d95b902
1 parent faa7f39
commit d95b902
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/lib/middleware/session.js b/lib/middleware/session.js
@@ -230,7 +230,8 @@ function session(options){
     // parse url
     var url = parse(req)
       , path = url.pathname
-      , originalHash;
+      , originalHash
+      , originalId;
 
     // expose store
     req.sessionStore = store;
@@ -260,8 +261,8 @@ function session(options){
       // browser-session length cookie
       if (null == cookie.expires) {
         if (!isNew) return debug('already set browser-session cookie');
-      // compare hashes
-      } else if (originalHash == hash(req.session)) {
+      // compare hashes and ids
+      } else if (originalHash == hash(req.session) && originalId == req.session.id) {
         return debug('unmodified session');
       }
 
@@ -329,6 +330,7 @@ function session(options){
       } else {
         debug('session found');
         store.createSession(req, sess);
+        originalId = req.sessionID;
         originalHash = hash(sess);
         next();
       }

diff --git a/test/session.js b/test/session.js
@@ -285,6 +285,7 @@ describe('connect.session()', function(){
           .get('/')
           .set('Cookie', 'connect.sid=' + id)
           .end(function(res){
+            sid(res).should.not.equal('');
             sid(res).should.not.equal(id);
             done();
           });