expressjs / expressjs/session

Request: Option for refreshing the session ID

Open
#425 18 comments 7 reactions 0 assignees View on GitHub
help wanted
Dominant language
JavaScript
Stars
6.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Sometimes, there is the need to refresh the session ID **without** loosing the session data.

Examples:
1. Refreshing session ID after authentication (to protect against session fixation attacks)
https://www.owasp.org/index.php/Session_fixation
https://github.com/jaredhanson/passport/issues/192
2. Manually refreshing session ID before it expires (e.g. if the user wants to keep working after the maximum session lifetime, but we do not want the same session ID to be used)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.