javascript - Express js session-- Create only for logged in users - Stack Overflow

admin管理员组

文章数量:1418706

I'm using express-session Node module for secure session cookies.

// Secure session cookie that ensures certain requests require an active session
app.use(expressSession({
    secret: "wouldn'tyouliketoknow", 
    cookie: {
        maxAge: new Date(Date.now() + 3600), // 1 hour
        httpOnly: true, 
        secure: true, // Requires https connection
    }, 
    // Stores sessions in Mongo DB
    store: new MongoStore({
        host: mongo, 
        port: 27017, 
        db: 'iod', 
        collection: 'sessions'
    }),
    // Gets rid of the annoying deprecated messages
    resave: false, 
    saveUninitialized: false
}));

This creates a secure session cookie no matter what the request is. I only wanna create a session only for when a user successfully logs in, e.g. a request like this:

app.get("/authenticate/:username/:password", function(req, res, next) {
    ...
});

Basically I want the cookie created only when a condition is successfully met within the get handler.

How would I go about doing that? Appreciated

I'm using express-session Node module for secure session cookies.

// Secure session cookie that ensures certain requests require an active session
app.use(expressSession({
    secret: "wouldn'tyouliketoknow", 
    cookie: {
        maxAge: new Date(Date.now() + 3600), // 1 hour
        httpOnly: true, 
        secure: true, // Requires https connection
    }, 
    // Stores sessions in Mongo DB
    store: new MongoStore({
        host: mongo, 
        port: 27017, 
        db: 'iod', 
        collection: 'sessions'
    }),
    // Gets rid of the annoying deprecated messages
    resave: false, 
    saveUninitialized: false
}));

This creates a secure session cookie no matter what the request is. I only wanna create a session only for when a user successfully logs in, e.g. a request like this:

app.get("/authenticate/:username/:password", function(req, res, next) {
    ...
});

Basically I want the cookie created only when a condition is successfully met within the get handler.

How would I go about doing that? Appreciated

• javascript
• node.js
• session
• cookies
• express

Share Improve this question Follow edited Oct 29, 2014 at 15:13 Wes asked Oct 29, 2014 at 14:46 WesWes 1,29133 gold badges2727 silver badges5353 bronze badges

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 5

So express will run middleware in the order you add it to the app. So the normal strategy here to achieve your goal would be to make sure you define:

1. All static and non-session routes (images, fonts, css, marketing pages, etc)
2. The session middleware
3. All application routes. You can't just have this on your login route because you'll need to enforce a logged-in user on all application routes requiring both a session as well as an authenticated user.

But specifically to answer you question even though this approach is not ultimately viable, you would just convert your session from a global middleware to a middleware added just to that one route:

var sessionMW = expressSession({
    secret: "wouldn'tyouliketoknow", 
    cookie: {
        maxAge: new Date(Date.now() + 3600), // 1 hour
        httpOnly: true, 
        secure: true, // Requires https connection
    }, 
    // Stores sessions in Mongo DB
    store: new MongoStore({
        host: mongo, 
        port: 27017, 
        db: 'iod', 
        collection: 'sessions'
    }),
    // Gets rid of the annoying deprecated messages
    resave: false, 
    saveUninitialized: false
});
app.get("/authenticate/:username/:password", sessionMW, function(req, res, next) {
    ...
});

本文标签： javascriptExpress js session Create only for logged in usersStack Overflow