expressjs/session

Request: Option for refreshing the session ID

开放

#425 创建于 2017年2月9日

 (18 条评论) (7 个反应) (0 位负责人)JavaScript (977 个派生)batch import
help wanted

仓库指标

星标
 (6,073 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

Sometimes, there is the need to refresh the session ID without loosing the session data.

Examples:

  1. Refreshing session ID after authentication (to protect against session fixation attacks) https://www.owasp.org/index.php/Session_fixation https://github.com/jaredhanson/passport/issues/192
  2. Manually refreshing session ID before it expires (e.g. if the user wants to keep working after the maximum session lifetime, but we do not want the same session ID to be used)

贡献者指南