This package adds support for sessions to the Curveball framework.
Features:
- It's lazy. It will only start a session if there is something in the store.
- It will also automatically wipe the session data if session data was emptied.
- It provides features for generating and validating CSRF tokens.
npm install @curveball/session
If you are upgrading from a 0.5.x release or earlier, this package introduces a BC break since 0.6.
In 0.5 session data was available in ctx.state.session
and
ctx.state.sessionId
, but this has been moved to ctx.session
and
ctx.sessionId
.
import session from '@curveball/session';
app.use(session({
store: 'memory',
});
This will add the in-memory session store to curveball. This store is mostly meant for testing.
Here is another example with more options:
import session from '@curveball/session';
app.use(session({
store: 'memory',
cookieName: 'MY_SESSION',
expiry: 7200,
cookieOptions: {
secure: true,
path: '/',
sameSite: true,
},
});
-
cookieName
- Updates the name of the HTTP Cookie. It'sCB
by default. -
expiry
- The number of seconds of inactivity before the session disappears. this is 3600 seconds by default. It only pertains to the longevity of the session in the store, it doesn't influence cookie parameters. -
cookieOptions
- If set, override cookie options from the default. The list of supported options can be found in the documentation of the [cookie package][3].
In your own controllers and middlewares, you can set and update session data
via the ctx.session
property.
app.use( ctx => {
// Running this will create the session
ctx.session = { userId: 5 };
ctx.response.body = 'Hello world';
});
To delete an open session, just clear the session data:
app.use( ctx => {
// Running this will create the session
ctx.session = null;
});
If you clear the session id, but there is still data, the middleware will remove the old session and automatically create a new session id:
app.use( ctx => {
// This will kill the old session and start a new one with the same data.
ctx.sessionId = null;
});
To obtain a CSRF token for forms, the middleware provides a getCsrf()
function:
app.use( async ctx => {
// Obtain a CSRF token for HTML forms:
const csrfToken = await ctx.getCsrf();
});
It's recommended to embed this token in HTML forms as such:
<input type="hidden" name="csrf-token" value="....token goes here" />
Then on POST
requests, you can easily validate the token with the validateCsrf
function. If the token was incorrect, this will automatically result in a 403
error:
app.use(route.post('/form-submit', ctx => {
// Throws error if csrf-token was not supplied or incorrect
ctx.validateCsrf();
}));
It's desirable to create your own stores for product usage. Eventually this project will probably add a few more default stores.
Until then, you must implement the following interface:
interface SessionStore {
set(id: string, values: SessionValues, expire: number): Promise<void>;
get(id: string): Promise<SessionValues>,
delete(id: string): Promise<void>,
newSessionId(): Promise<string>,
}
SessionValues
is simply a key->value object. expire
is expressed as a unix
timestamp.