Express session manager.
npm install @universal-packages/express-session
npm install expressInitialize a Session object
import { session } from '@universal-packages/express-session'
import { RedisEngine } from '@universal-packages/universal-token-registry-redis'
import express from 'express'
const engine = new RedisEngine({ host: 'localhost' })
await engine.connect()
const app = express()
app.use(session({ engine }))Session takes the same options as Token Registry
Additionally:
-
cookieNameStringdefault: "session"Name of the cookie to fetch for the session token. -
registryIdStringString to use to add randomness to the token generation. -
trackSessionAccessBooleanUpdate registry every time a request is made to track ip and last access changes.
Use this for a simple request rejection if the session was not authenticated.If not authenticated the middleware ends the response with unauthorized status.
import { authenticateRequest } from '@universal-packages/express-session'
app.get('/private', authenticateRequest, async (request, response) => {
response.end()
})Authenticating request is very simple you can even add your own logic like setting a current user to use later.
export async function authenticateRequest(request, response, next) {
if (request.session.authenticated) {
request.currentUser = await User.find(request.session.authenticatableID)
next()
} else {
response.status(401).end()
}
}You can either set the header Authorization in the format bearer <token> or configure express to parse cookies and set a session cookie with the token value, more about how to get a token below.
When the middleware is in use a Session object will be available in the request object.
app.get('/', async (request, response) => {
const currentUser = await User.find(request.session.authenticatableID)
response.end()
})True whe a request was authenticated with a token.
A unique id for the session aside from the token.
The same id used to create the session at log in.
The token that came with the request.
Date in which the session was created at log in.
Date of the current moment using the session token.
Request ip when the session was created at log in.
Request ip of the current moment using the session token.
User agent in which the session was created at log in.
Creates a new session using the authenticatable id and sets the cookie session as well as the Authorization response header to return to the user when ending the response.
Disposes the current session from the registry so the token is no longer valid, or if a token is provided it will dispose that session instead.
Returns all the active sessions for the current session authenticatable.
Returns all the active sessions for the authenticatable id.
-
authenticatableIdStringThe id of the authenticatable to get the active sessions from. -
optionsObjectSame options as Token Registry
To only inject the session object into the request and don't behave as middle ware use this method. In case you are doing some custom middleware.
import { injectSession } from '@universal-packages/express-session'
import express from 'express'
const app = express()
app.use(async (request, response, next) => {
await injectSession(request, response, options)
next()
})In order for typescript to see the global types you need to reference the types somewhere in your project, normally ./src/globals.d.ts.
/// <reference types="@universal-packages/express-session" />This library is developed in TypeScript and shipped fully typed.
The development of this library happens in the open on GitHub, and we are grateful to the community for contributing bugfixes and improvements. Read below to learn how you can take part in improving this library.