Setting different session prefix per user in express-session with connect-redis - express

Using latest version of node, express, express-session and connect-redis.
I'm trying to achieve a bit more control over sessions of other users from the backend.
For example, I'd like to change/delete a specific user's session without them making a request (so I don't have access to req.session.destroy() or any of that).
store.all(callback) Provides a way to fetch all users in the store, but with many users this is a sub-optimal solution. Therefore, I am wondering if there's a way to set per user prefixes on the redis keys so they may be retrieved. Default is sess:some_very_long_id, and I want sess:my_username:long_id.
It is worth mentioning that we can fetch a single session from the redis store but it would require saving all the session ids related to each user elsewhere which is also not optimal.
Some sample code for context
const redisclient = require('./redis');
const express = require('express');
const expressSess = require('express-session');
const RedisStore = require('connect-redis')(expressSess);
const store = new RedisStore({ client: redisclient });
const session = expressSess({
store : store,
secret : 'mysecret',
sameSite : true,
proxy : true,
key : 'sid',
resave : false,
saveUninitialized : false,
ttl : 60 * 60 * 24 * 2,
cookie: {
httpOnly : true,
secure : true,
maxAge : 2147483647,
},
});
app.use(express.json());
app.use(session);
... some endpoint where I want to implement deleting or editing sessions as an admin

Related

#shopify/shopify-api nodejs - Set permanent access token for private app installed on only one store

The shopifyApi reference does not have a private app permanent access token property. I have a custom private app that is installed on only one store and I have the permanent access token so I don't need to oAuth every time I'm calling the REST API. Would be great to have a documented straight forward example of how to do this. The docs are hairy, IMO.
#shopify/shopify-api version: 6.1.0
Is the following close? I'm looking at the Session object and trying to understand how to load an offline session and set the Session with correct SessionParams.
import '#shopify/shopify-api/adapters/node'
import { shopifyApi, LATEST_API_VERSION, Session } from '#shopify/shopify-api'
const shopify = shopifyApi({
apiKey: 'myprivateappkey',
apiSecretKey: 'myprivateappsecret',
apiVersion: LATEST_API_VERSION,
isPrivateApp: true,
scopes: ['read_products'],
isEmbeddedApp: false,
hostName: 'shop.myshopify.com',
})
const sessionId = shopify.session.getOfflineId('shop.myshopify.com')
const session = new Session({
id: sessionId,
shop: 'shop.myshopify.com',
state: 'state',
isOnline: false,
accessToken: 'permanentAccessToken',
})
const client = new shopify.clients.Rest({ session: session })
On older v5 version of shopify-api, with two lines I could access any REST API, but I see this is now deprecated, So I'm trying to unravel offline sessions, but it doesn't make sense to provide the api key and api secret and then create a session using the permanent access token.
import Shopify from '#shopify/shopify-api'
const client = new Shopify.Clients.Rest(
'mystore.myshopify.com',
'permanentAccessTokenString',
)
See answer from Shopify here.
When creating the client in a private app, a dummy session can be created like so
const session = new Session({
id: 'not-a-real-session-id',
shop: 'shop.myshopify.com,
state: 'state',
isOnline: false,
});
const client = new shopify.clients.Rest({ session: session })
When config.isPrivateApp is set to true only the shop property is used by the client - the other three (id, state, isOnline) properties are ignored (but are required when creating a Session object).
config.apiSecretKey is used as the access token, and is read directly from the config (no need to set the accessToken property of the dummy session as it will be ignored).
Essentially, config.apiSecretKey is the permanent access token for a private app.
The scopes can be omitted, as it defaults to an empty scopes array internally anyway and (from a quick search through the library code) is only used when doing OAuth, validating sessions, etc., which won't apply to private apps.
As for the apiKey, while it's mostly used as part of the OAuth process, it is also used in a few other places (e.g., shopify.auth.getEmbeddedAppUrl()), so I'd recommend setting the apiKey to be that of your private app.
However, in my testing, scopes, even when isPrivateApp, are currently required. If you leave the array empty for scopes it will have a config error.
Also, my shopifyApi config mounts rest resources so that when you're in Shopify REST docs on the nodejs tab, you can easily use the REST resources examples on the nodejs to make calls, rather than creating a REST client and use standard post, etc.
Complete code to setup a private app connection to Shopify:
import '#shopify/shopify-api/adapters/node'
import { shopifyApi, LATEST_API_VERSION, Session } from '#shopify/shopify-api'
import { restResources } from '#shopify/shopify-api/rest/admin/2023-01'
const debug = process.env.FUNCTIONS_EMULATOR === 'true'
const shopify = shopifyApi({
apiKey: 'myprivateAppApiKey',
apiSecretKey: 'myPermanentAccessToken',
apiVersion: LATEST_API_VERSION,
isPrivateApp: true,
scopes: [
'read_customers',
'write_customers',
'read_fulfillments',
'write_fulfillments',
'read_inventory',
'write_inventory',
'write_order_edits',
'read_order_edits',
'write_orders',
'read_orders',
'write_products',
'read_products',
],
isEmbeddedApp: false,
hostName: debug ? '127.0.0.1:5001' : 'shop.myshopify.com',
// Mount REST resources.
restResources,
})
// Create a sanitized "fake" sessionId. E.g.
// "offline_my.myshopify.com".
const sessionId = shopify.session.getOfflineId('shop.myshopify.com')
const session = new Session({
id: sessionId,
shop: 'shop.myshopify.com,
state: 'state',
isOnline: false,
})
// Use mounted REST resources to make calls.
const transactions = await shopify.rest.Transaction.all({
session,
order_id: 123456789,
})
// Alternatively, if not using mounted REST resources
// you could create a standard REST client.
const client = new shopify.clients.Rest({ session })

How can I persist a login forever, from a different browser?

Background:
I have an app (node, expressjs, express-session, redis) which, despite not setting maxAge or expires, seems to timeout logins after a while.
Intention:
Via the admin panel, I want admins to be able to view current sessions (already working, by grabbing sess:* from redis), and click a persist button on a session to make it last indefinitely.
I need a reliable way of going from the data stored against the sess:... to a unique identifier that I can reference to the browser instance. Probably, storing something at login that is signed, and then saving that into a permanent db that is checked alongside the session check (and sets up a new authenticated session if needed).
EDIT: To clarify 'from a different browser' - this is for the admin function. So the goal is to have a list of current sessions (achieved already), with a "persist this login" button on each.
This would mean that the user in question then doesn't get logged out.
EDIT: This is my current code for session handling:
const express = require('express') // v4.17.1
const app = express()
const redis = require('redis') // v4.5.1
const expressSession = require('express-session') // v1.17.2
const RedisStore = require('connect-redis')(expressSession) // v3.4.2
const redisClient = redis.createClient({ legacyMode: true })
redisClient.connect()
const session = expressSession({
store: new RedisStore({ client: redisClient }),
saveUninitialized: true,
secret: ‘xxxxxxx’,
resave: true
})
app.use(session)
Answering first part:
How can I persist a login forever, from a different browser? ... I have an app (node, expressjs, express-session, redis) which, despite not setting maxAge or expires, seems to timeout logins after a while.
If you don't set express-session cookie.maxAge or cookie.expires then redis-connect will set a default TTL of one day:
If the session cookie has a expires date, connect-redis will use it as the TTL. Otherwise, it will expire the session using the ttl option (default: 86400 seconds or one day). -- https://github.com/tj/connect-redis#ttl
You can disable that by setting redis-connect disableTTL option to true. It is not recommended you do this (see next part).
(Note, It could also be something completely different like your users are deleting your cookies when they close browser, or you have a SPA and session aren't tracking properly across refresh etc).
Answering second part:
Summarizing my understanding on what you want:
A user can have many login sessions, 1 per device and upto N active sessions (what N is or how it is imposed is beyond the scope).
Some of those sessions you want to dynamically make forever sessions using this hypothetical button on the hypothetical admin panel.
So what you seem to want to do is uniquely identify each user's devices and be able to dynamically toggle the session lifetime for the given device between some default and forever. It's device id that matters, session ids are kind of incidental here.
If you want to do this with express-session I would suggest not trying to use disableTTL, but just setting a really large cookie.maxAge for these sessions (5 years is practically forever in web apps, and you can touch the session every time the user is active to reset TTL as well).
Below is proof of concept code to do that. Note code uses latest versions at time of writing - will probably break with other versions. You'll need to fill in the details:
Store the flag indicating which devices are forever devices in your user DB.
Figure out how to uniquely identify each device the user logs in with (I would suggest just grouping device types and only allow one session on each type but I don't know enough about what your trying to do to give more specific advice).
Update active session when the admin toggles the button on the admin panel or whatever.
const express = require('express');
const redis = require('redis');
const session = require('express-session'); // https://github.com/expressjs/session
const app = express();
const port = 3000;
const RedisStore = require('connect-redis')(session);
const redisClient = redis.createClient({
url: 'redis://localhost',
legacyMode: true,
});
redisClient.connect()
.then(() => { console.log('Redis client connected'); })
.catch(console.error);
const DAY_IN_MS = 60 * 60 * 24 * 1000;
const YEAR_IN_MS = 365 * DAY_IN_MS;
// Mock user DB.
const users = {
bob: {
id: 'bob',
forever_devices: ['foo_device', 'bah_device']
}
};
app.use(session({
store: new RedisStore({
client: redisClient,
// disableTTL: true, // Dont need this.
}),
secret: 'keyboards',
saveUninitialized: false,
resave: true,
cookie: {
maxAge: 3*DAY_IN_MS // Default 3 days.
},
}));
app.listen(port, () => console.log(`App listening on port ${port}!`));
app.use((req, res, next) => {
console.log(req.query, req.sessionID, req.session);
next();
});
// Mock login accepting a mock user id and device_id. Obviously insecure ..
app.get('/login', (req, res) => {
const { id, device_id } = req.query;
if(!(id in users)) {
return res.send('Denied').status(401);
}
req.session.loggedIn = true;
if(users[id].forever_devices?.includes(device_id)) {
req.session.cookie.maxAge = YEAR_IN_MS*1000;
}
res.send('OK');
});
app.get('/logout', (req, res) => {
req.session.destroy();
res.send('OK');
});
app.get('/', async function (req, res) {
if(req.session.loggedIn) {
redisClient.v4.ttl(`sess:${req.sessionID}`).then((d) => {
res.send(`Hi ${req.sessionID} your TTL is ${d}`);
});
} else {
res.send('Not logged in');
}
});
Testing with curl (you'll need to start redis on localhost with no credentials):
> curl -b cjar -c cjar 127.0.0.1:3000/login?id=bob
OK
> curl -b cjar -c cjar 127.0.0.1:3000/
Hi sukXf3ddjx3AMakVGIfChvlI-_KhaPqQ your TTL is 259196
> curl -b cjar -c cjar 127.0.0.1:3000/logout
OK
> curl -b cjar -c cjar "127.0.0.1:3000/login?id=bob&device_id=foo_device"
OK
> curl -b cjar -c cjar 127.0.0.1:3000/
Hi 81JZL-PxCRhNclktuYxHjTeHibaoNP9G your TTL is 31535999997
> curl -b cjar -c cjar 127.0.0.1:3000/logout
OK
> curl -b cjar -c cjar 127.0.0.1:3000/
Not logged in

Express-session changes session id on refresh (Guest login attempt)

I'm trying to create a guest account for a portfolio website so that recruiters can play with it without having to register and set things up, but I need the account to be session or IP specific so that users can have their own guest account without interfering with each other.
I thought about achieving that by using the sessionID within ApolloServer's context.req as the account name but I've noticed I get a different sessionID on every request/refresh.
My backend's session setup looks like this:
const app = express();
// Initialize redis sessions server
const redisConfig = app.get('env') === 'production' ? { host: 'redis' } : undefined; // Change host from default to the name of the docker service (redis) when in production
const RedisStore = connectRedis(session);
const redisClient = redis.createClient(redisConfig); // This would take the connection parameters, but we leave the default values: https://redislabs.com/lp/node-js-redis/
// Tell express that we have a proxy in front of our app so that sessions work when using Nginx: http://expressjs.com/en/guide/behind-proxies.html#express-behind-proxies
if (app.get('env') === 'production') app.set("trust proxy", 1);
app.use(
cors({
origin: process.env.CORS_ORIGIN,
credentials: true
})
);
app.use(
session({
name: COOKIE_NAME,
store: new RedisStore({
client: redisClient,
disableTTL: true, // TTL: time to live, how long the session is active, if we want our sessions to be active permanently until manually disabled.
disableTouch: true, // Prevent that the TTL is reset every time a user interacts with the server.
}),
cookie: {
maxAge: 10 * 365 * 24 * 60 * 60 * 1000, // How long in miliseconds until the cookie expires (10 years)
httpOnly: app.get('env') === 'production', // Prevents JS in the frontend from accessing the cookie.
// domain: app.get('env') === 'production' ? 'websitename.com' : undefined,
secure: app.get('env') === 'production', // Cookie only works in https
sameSite: 'lax',
},
saveUninitialized: false, // Prevents that empty sessions are created.
secret: `${process.env.SECRET}`,
resave: false, // False to prevent constant pinging to Redis
})
);
And in my frontend:
const client = new ApolloClient({
cache: new InMemoryCache(),
link: new HttpLink({
uri: process.env.API_URL,
credentials: 'include', // Required for sessions. Sends our cookie back to the server with every request.
})
});
This happens both in my local dev environment and in my deployed https website. I've seen similar issues with suggestions about changing the secure and samesite parameters or the CORS config, but that hasn't worked for me so far.
Any idea of what the issue might be? Is this just not the right approach to do what I'm after?
Sorry if it's something super-obvious, haven't touched my server in months and my backend skills are a bit rusty '^^.

Calling express-session backed by connect-redis inside websockets/ws

Okay so here goes. I am trying to to use express-session backed by connect-redis together with websockets/ws. The vast majority of example code I have seen usually includes the use of Express to serve the client a websocket script of some type and then configuring the server app to use the express-session middleware to work with session data...with websockets further down the process chain.
My client side app on the other hand immediately initiates an Opening Handshake/Upgrade request, which bypasses Express and heads straight into websockets/ws. For this reason I am not able to work with session data through the commonly used app.use(session(...) middleware setup.
The below code uses a setup that allows me to call express-session inside websocket/ws and to put the connection request through express-session so I can get at the session data. This works as is shown by the output also below. What does not work however is backing express-session by connect-redis inside this setup. To check I call a redis client directly to query my redis box after express-session has run, no keys are returned.
I have three questions:
1. Is what I am doing below the 'correct' way of integrating express-session with websockets/ws for the client setup described?
2. If not what should I be doing?
3. If this is a good way, is it possible to get connect-redis working as session store?
Your insights are very welcome.
Server-side code:
const express = require('express');
const Session = require('express-session');
const http = require('http');
const ws = require('ws');
const util = require('util');
const redis = require('redis');
const client = redis.createClient(6379, '10.0.130.10', {no_ready_check: true});
const RedisStore = require('connect-redis')(Session);
const SessionStore = new RedisStore({host: '10.0.130.10', port: '6379', ttl: 60, logErrors: true});
//const SessionStore = new Session.MemoryStore();
var session = Session({
store: SessionStore,
cookie: {secure: true, maxAge: 3600, httpOnly: true},
resave: false,
saveUninitialized: true,
secret: '12345'
});
// Define Express and WS servers
const app = express();
const server = http.createServer(app);
const wss = new ws.Server({ server });
// WS Websocket
wss.on('connection', function connection(ws, req) {
session(req, {}, function(){
let sessionId = req.sessionID;
console.log('SessionID: ' + sessionId);
let sessionCookie = req.session.cookie;
console.log('SessionCookie: ' + JSON.stringify(sessionCookie));
});
client.keys('*', function(err, reply) {
// reply is null when the key is missing
console.log('Redis reponse: ' + reply);
});
});
server.listen(10031, function listening() {
console.log('Listening on: ' + server.address().port);
});
Server-side console.log output (note the Redis response):
Listening on: 10031
SessionID: Oi8AdsoZTAm3hRLmxPfGo43Kmmj_Yd6F
SessionCookie: {"originalMaxAge":3599,"expires":"2017-05-29T17:45:54.467Z","secure":true,"httpOnly":true,"path":"/"}
Redis reponse:
Reference:
express-session, connect-redis and einaros/ws
Reference:
ExpressJS & Websocket & session sharing

Socket.IO Authentication

I am trying to use Socket.IO in Node.js, and am trying to allow the server to give an identity to each of the Socket.IO clients. As the socket code is outside the scope of the http server code, it doesn't have easy access to the request information sent, so I'm assuming it will need to be sent up during the connection. What is the best way to
1) get the information to the server about who is connecting via Socket.IO
2) authenticate who they say they are (I'm currently using Express, if that makes things any easier)
Use connect-redis and have redis as your session store for all authenticated users. Make sure on authentication you send the key (normally req.sessionID) to the client. Have the client store this key in a cookie.
On socket connect (or anytime later) fetch this key from the cookie and send it back to the server. Fetch the session information in redis using this key. (GET key)
Eg:
Server side (with redis as session store):
req.session.regenerate...
res.send({rediskey: req.sessionID});
Client side:
//store the key in a cookie
SetCookie('rediskey', <%= rediskey %>); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
//then when socket is connected, fetch the rediskey from the document.cookie and send it back to server
var socket = new io.Socket();
socket.on('connect', function() {
var rediskey = GetCookie('rediskey'); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
socket.send({rediskey: rediskey});
});
Server side:
//in io.on('connection')
io.on('connection', function(client) {
client.on('message', function(message) {
if(message.rediskey) {
//fetch session info from redis
redisclient.get(message.rediskey, function(e, c) {
client.user_logged_in = c.username;
});
}
});
});
I also liked the way pusherapp does private channels.
A unique socket id is generated and
sent to the browser by Pusher. This is
sent to your application (1) via an
AJAX request which authorizes the user
to access the channel against your
existing authentication system. If
successful your application returns an
authorization string to the browser
signed with you Pusher secret. This is
sent to Pusher over the WebSocket,
which completes the authorization (2)
if the authorization string matches.
Because also socket.io has unique socket_id for every socket.
socket.on('connect', function() {
console.log(socket.transport.sessionid);
});
They used signed authorization strings to authorize users.
I haven't yet mirrored this to socket.io, but I think it could be pretty interesting concept.
I know this is bit old, but for future readers in addition to the approach of parsing cookie and retrieving the session from the storage (eg. passport.socketio ) you might also consider a token based approach.
In this example I use JSON Web Tokens which are pretty standard. You have to give to the client page the token, in this example imagine an authentication endpoint that returns JWT:
var jwt = require('jsonwebtoken');
// other requires
app.post('/login', function (req, res) {
// TODO: validate the actual user user
var profile = {
first_name: 'John',
last_name: 'Doe',
email: 'john#doe.com',
id: 123
};
// we are sending the profile in the token
var token = jwt.sign(profile, jwtSecret, { expiresInMinutes: 60*5 });
res.json({token: token});
});
Now, your socket.io server can be configured as follows:
var socketioJwt = require('socketio-jwt');
var sio = socketIo.listen(server);
sio.set('authorization', socketioJwt.authorize({
secret: jwtSecret,
handshake: true
}));
sio.sockets
.on('connection', function (socket) {
console.log(socket.handshake.decoded_token.email, 'has joined');
//socket.on('event');
});
The socket.io-jwt middleware expects the token in a query string, so from the client you only have to attach it when connecting:
var socket = io.connect('', {
query: 'token=' + token
});
I wrote a more detailed explanation about this method and cookies here.
Here is my attempt to have the following working:
express: 4.14
socket.io: 1.5
passport (using sessions): 0.3
redis: 2.6 (Really fast data structure to handle sessions; but you can use others like MongoDB too. However, I encourage you to use this for session data + MongoDB to store other persistent data like Users)
Since you might want to add some API requests as well, we'll also use http package to have both HTTP and Web socket working in the same port.
server.js
The following extract only includes everything you need to set the previous technologies up. You can see the complete server.js version which I used in one of my projects here.
import http from 'http';
import express from 'express';
import passport from 'passport';
import { createClient as createRedisClient } from 'redis';
import connectRedis from 'connect-redis';
import Socketio from 'socket.io';
// Your own socket handler file, it's optional. Explained below.
import socketConnectionHandler from './sockets';
// Configuration about your Redis session data structure.
const redisClient = createRedisClient();
const RedisStore = connectRedis(Session);
const dbSession = new RedisStore({
client: redisClient,
host: 'localhost',
port: 27017,
prefix: 'stackoverflow_',
disableTTL: true
});
// Let's configure Express to use our Redis storage to handle
// sessions as well. You'll probably want Express to handle your
// sessions as well and share the same storage as your socket.io
// does (i.e. for handling AJAX logins).
const session = Session({
resave: true,
saveUninitialized: true,
key: 'SID', // this will be used for the session cookie identifier
secret: 'secret key',
store: dbSession
});
app.use(session);
// Let's initialize passport by using their middlewares, which do
//everything pretty much automatically. (you have to configure login
// / register strategies on your own though (see reference 1)
app.use(passport.initialize());
app.use(passport.session());
// Socket.IO
const io = Socketio(server);
io.use((socket, next) => {
session(socket.handshake, {}, next);
});
io.on('connection', socketConnectionHandler);
// socket.io is ready; remember that ^this^ variable is just the
// name that we gave to our own socket.io handler file (explained
// just after this).
// Start server. This will start both socket.io and our optional
// AJAX API in the given port.
const port = 3000; // Move this onto an environment variable,
// it'll look more professional.
server.listen(port);
console.info(`🌐 API listening on port ${port}`);
console.info(`🗲 Socket listening on port ${port}`);
sockets/index.js
Our socketConnectionHandler, I just don't like putting everything inside server.js (even though you perfectly could), especially since this file can end up containing quite a lot of code pretty quickly.
export default function connectionHandler(socket) {
const userId = socket.handshake.session.passport &&
socket.handshake.session.passport.user;
// If the user is not logged in, you might find ^this^
// socket.handshake.session.passport variable undefined.
// Give the user a warm welcome.
console.info(`⚡︎ New connection: ${userId}`);
socket.emit('Grettings', `Grettings ${userId}`);
// Handle disconnection.
socket.on('disconnect', () => {
if (process.env.NODE_ENV !== 'production') {
console.info(`⚡︎ Disconnection: ${userId}`);
}
});
}
Extra material (client):
Just a very basic version of what the JavaScript socket.io client could be:
import io from 'socket.io-client';
const socketPath = '/socket.io'; // <- Default path.
// But you could configure your server
// to something like /api/socket.io
const socket = io.connect('localhost:3000', { path: socketPath });
socket.on('connect', () => {
console.info('Connected');
socket.on('Grettings', (data) => {
console.info(`Server gretting: ${data}`);
});
});
socket.on('connect_error', (error) => {
console.error(`Connection error: ${error}`);
});
References:
I just couldn't reference inside the code, so I moved it here.
1: How to set up your Passport strategies: https://scotch.io/tutorials/easy-node-authentication-setup-and-local#handling-signupregistration
This article (http://simplapi.wordpress.com/2012/04/13/php-and-node-js-session-share-redi/) shows how to
store sessions of the HTTP server in Redis (using Predis)
get these sessions from Redis in node.js by the session id sent in a cookie
Using this code you are able to get them in socket.io, too.
var io = require('socket.io').listen(8081);
var cookie = require('cookie');
var redis = require('redis'), client = redis.createClient();
io.sockets.on('connection', function (socket) {
var cookies = cookie.parse(socket.handshake.headers['cookie']);
console.log(cookies.PHPSESSID);
client.get('sessions/' + cookies.PHPSESSID, function(err, reply) {
console.log(JSON.parse(reply));
});
});
use session and Redis between c/s
Server side
io.use(function(socket, next) {
// get here session id
console.log(socket.handshake.headers.cookie); and match from redis session data
next();
});
this should do it
//server side
io.sockets.on('connection', function (con) {
console.log(con.id)
})
//client side
var io = io.connect('http://...')
console.log(io.sessionid)