From fcf4925dd0d70c85aa87f60a66607db8b7907d15 Mon Sep 17 00:00:00 2001 From: Calvin Rodo Date: Wed, 27 Nov 2019 12:55:39 -0500 Subject: [PATCH 1/3] Add multiple sessions App.js now just adds session configured in session.config.js Added express-session to deal with the problem with long cookies At the moment selecting the session is done through a code change I just can't think of a better place for it right now --- app.js | 8 +++---- config/cookieSession.config.js | 23 ------------------ config/session.config.js | 44 ++++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 28 deletions(-) delete mode 100755 config/cookieSession.config.js create mode 100755 config/session.config.js diff --git a/app.js b/app.js index ea047fd..cb1ce91 100755 --- a/app.js +++ b/app.js @@ -7,8 +7,7 @@ const cookieParser = require('cookie-parser') const compression = require('compression') const helmet = require('helmet') const path = require('path') -const cookieSession = require('cookie-session') -const cookieSessionConfig = require('./config/cookieSession.config') +const sessionConfig = require('./config/session.config') const { hasData } = require('./utils') const { addNunjucksFilters } = require('./filters') const csp = require('./config/csp.config') @@ -43,9 +42,8 @@ app.use(function(req, res, next) { next() }) -// in production: use redis for sessions -// but this works for now -app.use(cookieSession(cookieSessionConfig)) +// add the session selected in session.config.js +app.use(sessionConfig) // public assets go here (css, js, etc) app.use(express.static(path.join(__dirname, 'public'))) diff --git a/config/cookieSession.config.js b/config/cookieSession.config.js deleted file mode 100755 index 9528211..0000000 --- a/config/cookieSession.config.js +++ /dev/null @@ -1,23 +0,0 @@ -/* - configuration for our cookie sessions - - set a name for the session so that the cookie persists between server reloads - - if a COOKIE_SECRET environment variable, use that as a secret name - - else use a timestamp that rotates every 60 minutes - - also set cookie expiry time to 60 minutes - more docs here: https://expressjs.com/en/resources/middleware/cookie-session.html -*/ -const oneHour = 1000 * 60 * 60 -const sessionName = `ctb-${process.env.COOKIE_SECRET || - Math.floor(new Date().getTime() / oneHour)}` - -const cookieSessionConfig = { - name: sessionName, - secret: sessionName, - cookie: { - httpOnly: true, - maxAge: oneHour, - sameSite: true, - }, -} - -module.exports = cookieSessionConfig diff --git a/config/session.config.js b/config/session.config.js new file mode 100755 index 0000000..4647091 --- /dev/null +++ b/config/session.config.js @@ -0,0 +1,44 @@ +/* + configuration for our sessions + - set a name for the session so that the session persists between server reloads + - if a SESSION_SECRET environment variable, use that as a secret name + - else use a timestamp that rotates every 60 minutes + - also set session expiry time to 60 minutes + more docs here: https://expressjs.com/en/resources/middleware/cookie-session.html +*/ +const session = require('express-session') +const MemoryStore = require('memorystore')(session) +const cookieSession = require('cookie-session') + +const oneHour = 1000 * 60 * 60 +const sessionName = `ctb-${process.env.SESSION_SECRET || + Math.floor(new Date().getTime() / oneHour)}` + +const cookieSessionConfig = { + name: sessionName, + secret: sessionName, + cookie: { + httpOnly: true, + maxAge: oneHour, + sameSite: true, + }, +} +const memorySessionConfig = { + cookie: { httpOnly: true, maxAge: oneHour, sameSite: 'strict' }, + store: new MemoryStore({ + checkPeriod: oneHour, // prune expired entries every hour + }), + secret: sessionName, + resave: false, + saveUninitialized: false, + unset: 'destroy', +} + +const sessions = { + cookie : cookieSession(cookieSessionConfig), + memory: session(memorySessionConfig), +} + +// In production use redis but this works for now +const appSession = sessions.cookie +module.exports = appSession From b3153f8d0eb48fe118cc6c6950d903524cad4921 Mon Sep 17 00:00:00 2001 From: Calvin Rodo Date: Wed, 27 Nov 2019 14:32:54 -0500 Subject: [PATCH 2/3] Adding memorystore dependency --- package.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index 824412f..9464d2c 100755 --- a/package.json +++ b/package.json @@ -29,6 +29,8 @@ }, "dependencies": { "@cdssnc/webpack-starter": "^2.0.2", + "@csstools/postcss-sass": "^4.0.0", + "@fullhuman/postcss-purgecss": "^1.3.0", "compression": "^1.7.4", "cookie-parser": "~1.4.4", "cookie-session": "^1.3.3", @@ -43,12 +45,11 @@ "express-validator": "^6.2.0", "helmet": "^3.21.2", "i18n": "^0.8.4", + "memorystore": "^1.6.1", "mini-css-extract-plugin": "^0.8.0", "nunjucks": "^3.2.0", "request": "^2.88.0", - "tailwindcss": "^1.1.3", - "@csstools/postcss-sass": "^4.0.0", - "@fullhuman/postcss-purgecss": "^1.3.0" + "tailwindcss": "^1.1.3" }, "devDependencies": { "@aws-cdk/aws-docdb": "1.17.1", From d4169165fca085018389259367159f9706dfadb8 Mon Sep 17 00:00:00 2001 From: Calvin Rodo Date: Mon, 2 Dec 2019 12:50:13 -0500 Subject: [PATCH 3/3] Cleaning up sessions Removed Cookie Session Added a file based session store Standardized on session config other then backer --- .gitignore | 5 ++++- config/session.config.js | 32 +++++++++++--------------------- package.json | 3 ++- 3 files changed, 17 insertions(+), 23 deletions(-) diff --git a/.gitignore b/.gitignore index 3986356..15b3d32 100644 --- a/.gitignore +++ b/.gitignore @@ -73,4 +73,7 @@ cdk.out cdk.out cdk/local-image -credentials \ No newline at end of file +credentials + +#Ignore session added from file-session-store +sessions \ No newline at end of file diff --git a/config/session.config.js b/config/session.config.js index 4647091..0586c39 100755 --- a/config/session.config.js +++ b/config/session.config.js @@ -8,37 +8,27 @@ */ const session = require('express-session') const MemoryStore = require('memorystore')(session) -const cookieSession = require('cookie-session') +const FileStore = require('session-file-store')(session) const oneHour = 1000 * 60 * 60 const sessionName = `ctb-${process.env.SESSION_SECRET || Math.floor(new Date().getTime() / oneHour)}` - -const cookieSessionConfig = { - name: sessionName, - secret: sessionName, - cookie: { - httpOnly: true, - maxAge: oneHour, - sameSite: true, - }, + + +// In production use redis but this works for now +const store = { + memory: () => new MemoryStore({ checkPeriod: oneHour }), + fileStore: () => new FileStore({}), } -const memorySessionConfig = { + +const sessionConfig= { cookie: { httpOnly: true, maxAge: oneHour, sameSite: 'strict' }, - store: new MemoryStore({ - checkPeriod: oneHour, // prune expired entries every hour - }), + store: store.fileStore(), secret: sessionName, resave: false, saveUninitialized: false, unset: 'destroy', } -const sessions = { - cookie : cookieSession(cookieSessionConfig), - memory: session(memorySessionConfig), -} -// In production use redis but this works for now -const appSession = sessions.cookie -module.exports = appSession +module.exports = session(sessionConfig) diff --git a/package.json b/package.json index 9464d2c..149d14b 100755 --- a/package.json +++ b/package.json @@ -49,6 +49,7 @@ "mini-css-extract-plugin": "^0.8.0", "nunjucks": "^3.2.0", "request": "^2.88.0", + "session-file-store": "^1.3.1", "tailwindcss": "^1.1.3" }, "devDependencies": { @@ -82,7 +83,7 @@ "nodemonConfig": { "ext": "js,json,njk,scss", "ignore": [ - "public/dist/**/*.*" + "public/dist/**/*.*", "sessions/*" ] } }