Cookieless Session

[npshubh]

How can we implement cookie-less session in express js? Express-session provides a way to maintain session using cookies but what if we try to use express-session without cookies? Is there any way to achieve that?

[dougwilson]

You could just call the get and set methods on your store object directly.

[npshubh]

can you give me an example for that? How I'm supposed to do that?

[dougwilson]

So when you create the store object using your chosen store module, that module has various methods to interact with it like get, set, and more. Depending on how you're going to handle management of sessions without cookies, you would interact with the store module. This module is basically a "cookie adapter" for all the various stores. You would need to implement your own adapter over the stores to provide the functionality you're looking for.

[npshubh]

@dougwilson , when another user requests login using API, the first session stored in database is getting updated. So I'm losing session of previous user who was logged in using API. I'm unable to insert new session for each login request.

I can write custom code to achieve that but it worths to ask you if this library consists some logic to operate on such kind of scenario?

[dougwilson]

Hm, I've never seen that happen here. It would be a big bug for sure. Can you help me reproduce the issue? I can take a look. Please provide all the following:

1. Version of Node.js
2. Version of this module
3. Complete server code that reproduces the issue
4. Instructions on how to get the server running if it is more than copy and paste your provided code
5. Instructions on how to reproduce in tge browser. Usually (1) go to this address (2) click this link, etc.

Thanks!

[npshubh]

Node :- v9.2.1
"express-session": "^1.15.6",

Code is on my localhost so I can't show you but I can explain you the process -

1. I've used following code to setup

app.use(session({
secret: "test",
cookies: { maxAge: 600000,httpOnly: false },
saveUninitialized: false, // don't create session until something stored
resave: false, //don't save session if unmodified
store: new MongoStore({
mongooseConnection: mongoose.connection,
autoRemove: 'interval',
autoRemoveInterval: 10
})
}));

2. Now whenever a user "A" calls API "locahost/login" I'm setting a token "req.session.token = 'secret_token'; " and I get data in my mongodb database. Till now everything is fine, we have successfully created a session for user "A".

3. Now when another user "B" calls API "locahost/login" and tries to login, then session of user "A" gets updated. So if user "A" tries to login using his token, then I can't find that in db and user "A" is not able to login.
   What I wanted is to create different sessions for multiple users but I ended up with updating the same session.

This library seems to work fine with browser login but not working with API logins.

Hope now you've understood the problem.

[dougwilson]

I kinda follow, but not sure why that is happening in your code. I would love to attach a debugger and walk though it and see what is going on, if you're willing to provide the requested information. If not, I'm not sure how I can figure out what is happening.

[npshubh]

gateway.zip
here's the code.

[dougwilson]

Awesome, thanks! I just got to bed, so will check it out when off work tomorrow night (approx in 20 hours).