Request: Option for refreshing the session ID
Open
help wanted
- Dominant language
- JavaScript
- Stars
- 6.4k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Sometimes, there is the need to refresh the session ID **without** loosing the session data.
Examples:
1. Refreshing session ID after authentication (to protect against session fixation attacks)
https://www.owasp.org/index.php/Session_fixation
https://github.com/jaredhanson/passport/issues/192
2. Manually refreshing session ID before it expires (e.g. if the user wants to keep working after the maximum session lifetime, but we do not want the same session ID to be used)
Contributor guide
Assessment
This issue has not been assessed yet.