A session management plugin for Muneem web framework.
It generates a session id, creates a cookie for session id, and entry in session store where more data related to the session can be stored.
process.env.NODE_ENV = "dev";
const Muneem = require("muneem");
const satr = new require("satr")();
const store = require("some_store");
satr.on('create', (session, asked) => {
console.log("Creating a new session");
console.log( store.get(session.id) );
})
satr.on('renew', (session, asked) => {
console.log("Renewing an old session");
console.log( store.get(session.id) );
})
satr.on('invalid', (sessionId, asked) => {
console.log("Received an invalid session");
})
satr.on('save', (sessionId, asked) => {
console.log("saved session into cookies and store");
console.log( store.get(sessionId) );
})
const app = Muneem();
app.use(satr.manager, {
name : "session-id", //default is '_si'
autoCreate : false,
secret : "keep it secret and complex that no one can guess",// min 32 char or long
life : 600,//default is 3600
renewalDuration : 1,//duration before session end when session-id can be renewed
store : store,
cookie : {
httpOnly : true,
secure : false
}
});
/******************** Handlers ********************/
function authentication(asked, answer, giveMe){
const session = asked.getSession(); //current session if exist otherwise new unauthorized session
if( session.authorized ){
console.log("It is authorized session");
}else{
asked.hasSession = false; //it'll stop saving the temporary session to the store and cookies
answer.redirectTo("/login?sendTo=" + asked.path);
}
}
function loginHandler(asked, answer, giveMe){
//.. validate user
if( authInfo.isValid() ){
var session = asked.getSession();
session.authorized = true;
//.. save session data to session.data
/* session.data.userid = "authInfo.id";
session.add( "userid", "authInfo.id2" );
session.delete( "tempid");*/
answer.redirectTo( asked.q.sendTo ); //you'll have to parse query string yourself or use some plugin
}else{
answer.write('{ result : "fail"}', "application/json");
}
}
function logoutHandler(asked, answer, giveMe){
var session = asked.getSession();
session.authorized = false;
//.. delete from the store
answer.redirectTo( asked.q.sendTo || "/" );
}
function privatePageProvider(asked, answer, giveMe){
console.log("private page")
}
function publicPageProvider(asked, answer, giveMe){
console.log("private page")
}
/******************** End Handlers ********************/
app.route([{
uri : "/logout",
to : logoutHandler,
},{
uri : "/login",
to : loginHandler,
},{
uri : "/public/url",
to : publicPageProvider,
},{
uri : "/private/url",
to : privatePageProvider,
after: authentication
}]);
app.start();name : This plugin reads the session-id from cookie first, if not presents then reads from header.
A cookie is baked not only with it's name and value but other attributes like domain, expiry time/duration etc. Check cookie options for more detail.
life of the session (in seconds) will be set to cookie.expires .
If autoCreate option is set to true, this plugin will create session for each request if it was not previously created. Since all the sessions get saved to store at the time of sending the response, autoCreate:true may create an extra overhead on the session store. You may set it false to create sessions manually for login sessions only. If there is no session created, it'll not send cookies to the client. There are some cookie laws which don't want you to create cookies without user permission or create cookies relevant to your site only not luring ads.
store is optional for dev, ref, int, uat, test, qa environments. It'll log a warning. If the store is not provided then the sessions will be saved in memory which is not suitable for production and performance encvironment. A session store should have following methods
- set(sessionId, session, callback)
- get(sessionId, callback)
- destroy(sessionId, callback)
- A session-id is not expected once it's cookie has been expired. So the expiry time for auth session cookies should be longer for good user experience.
- Short session life is an overhead on server (session store). But long life lure the hackers
- To save users from middle-man attack use HTTPS connections with secure cookies.
- Keeping high number of sessions' data in memory may lead memory leak. So better to use some session-store in prod and performance.
- x-forwarded-proto header