expressjs/session

Request: Option for refreshing the session ID

開放

#425 建立於 2017年2月9日

 (18 則留言) (7 個反應) (0 位負責人)JavaScript (977 個分叉)batch import
help wanted

倉庫指標

星標
 (6,073 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

Sometimes, there is the need to refresh the session ID without loosing the session data.

Examples:

  1. Refreshing session ID after authentication (to protect against session fixation attacks) https://www.owasp.org/index.php/Session_fixation https://github.com/jaredhanson/passport/issues/192
  2. Manually refreshing session ID before it expires (e.g. if the user wants to keep working after the maximum session lifetime, but we do not want the same session ID to be used)

貢獻者指南