expressjs / expressjs/session

The capability to supply a serializer (parse, stringify) for the req.sessionID in setcookie & getcookie (due to privacy & security concerns)

Open
#468 7 comments 7 reactions 0 assignees View on GitHub
discuss
Dominant language
JavaScript
Stars
6.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Due to privacy/security concerns, we have to encrypt the sessionID that's stored within a cookie. It would be great, if we could set a cookie value/sessionID serializer within the session options so we can keep using your excellent module. I am aware of the reasons for 'signing' a cookie values and being able to 'encrypt' the sessionID should not replace 'signing' the cookie. It should be in addition to 'signing' the cookie value.

If I would supply you with a pullrequest (from a fork) that implements the following change, the option to supply your own sessionID/value serializer using options.serializer; would you be willing to consider it?
```js
function session(options) {
var opts = options || {};

// get/set the cookie value serializer
var serializer = opts.serializer || { parse: value => value, stringify: value => value };
...
}

// set cookie
setcookie(res, name, serializer.stringify(req.sessionID), secrets[0], req.session.cookie.data);

function getcookie(req, name, secrets) {
...
return serializer.parse(val);
}
```

Contributor guide

Open the contributing guide

Research direction

Start by locating the session(options) entry point and the setcookie and getcookie paths mentioned in the issue. Review how the existing cookie value is signed, then assess the proposed options.serializer parse and stringify hooks without replacing signing. Done means custom serialization works for both writing and reading the session ID while signing remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.