Prevent Expressjs from creating a session when requests contain an authorization header?

问题:

I have an API that can be called either using a browser where requests are transactional and have a session OR directly, eg. using curl, where requests are atomic. Browser requests must first authenticate and then use an express session (connect.sid) for subsequent authorization, direct API calls use a header: Authorization: "SOMETOKEN" which has to be sent for every request.

The problem I have is, because I'm using the same web server to serve both atomic and transactional traffic, every API call is needlessly being given a session by Express. Every response includes a Set-Cookie and all these sessions are filling up my session store. Therefore: how can I prevent Express from entering a new sess key in the memory store (Redis) when a request contains an Authorization header?

Note. I get that a more classic approach would be to have a separate API server and a separate WEB server but why not run both on one machine? To me, the difference is that the API serves data and the WEB serves views but beyond that they are both part of the same application. I just happen to also allow users to access their data directly and don't force them to use my interface.

Express Config

module.exports = function(app, exp, sessionStore, cookieParser, passport, flash) {      app.configure(function(){         // Templates         app.set('views', ERNEST.root + '/server/views');         app.set('view engine', 'jade');         app.set('view options', { doctype : 'html', pretty : true });          // Allow large files to be uploaded (default limit is 100mb)         app.use(exp.limit('1000mb'));          // Faux putting and deleting         app.use(exp.methodOverride());          // Static content         app.use(exp.static(ERNEST.root + '/server'));         app.use(exp.static(ERNEST.root + '/public'));          // Handle favicon         app.use(exp.favicon());          // For uploads         app.use(exp.bodyParser({keepExtensions: true}));          // Configure cookie parsing         if ( cookieParser ) app.use(cookieParser);         else app.use(exp.cookieParser());          // Where to store the session         var session_options = { 'secret': "and she put them on the mantlepiece" };         if ( sessionStore ) session_options.store = sessionStore;         app.use(exp.session( session_options ));          // Rememberance         app.use( function (req, res, next) {             if ( req.method == 'POST' && req.url == '/authenticate' ) {                 if ( req.body.rememberme === 'on' ) {                     req.session.cookie.maxAge = 2592000000; // 30*24*60*60*1000 Rememeber 'me' for 30 days                 } else {                     req.session.cookie.expires = false;                 }             }             next();         });          // PassportJS         if ( passport ){             app.use(flash());             app.use(passport.initialize());             app.use(passport.session());         }     });  }; 

An example route

app.get('/status/past_week', MID.ensureAuthenticated, MID.markStart, function(req, res) {     WEB.getStatus('week', function(err, statuses){         if ( err ) res.send(500, err);         else res.send(200, statuses);     }); }); 

Authorization Middleware

MID.ensureAuthenticated = function(req, res, next) {   if ( req.isAuthenticated() ) return next();   else {         isAuthorised(req, function(err, authorised){             if ( err ) return res.redirect('/');             else if ( authorised ) return next();             else return res.redirect('/');         });     }      function isAuthorised(req, callback){         var authHeader = req.headers.authorization;         if ( authHeader ) {             // Has header, verify it             var unencoded = new Buffer(authHeader, 'base64').toString();             var formatted = unencoded.toString().trim();             ACCOUNT.verifyAuth(formatted, callback); // verifyAuth callbacks next() when successful         } else callback(null, false); // No Authorised header     } }; 

回答1:

Try this:

var sessionMiddleware = exp.session( session_options );  app.use(function(req, res, next) {   if (req.headers.authorization) {     return next();   }   return sessionMiddleware(req, res, next); }); 

回答2:

Looks like you need to write your own session middleware. Here's an example. If you can create a separate subdomain, say, www.example.com for browser sessions and app.example.com for accessing it directly, then you should be able to use the linked method almost exactly, and just don't start the session for app.example.com requests. That may be the most direct method whereby the call indicates the method it intends to authenticate by, and any diversion from that is an error.

Otherwise, you'll have to detect the authentication token in the middleware and not start the session when you find it.

回答3:

An alternative approach to reducing the amount of sessions stored in your session storage is to set a default maxAge to something low. Then, when you actually need sessions stored longer, like after a user logins, you can set req.session.cookie.expires = null;. Also don't forget to set the session expiration to something low when the user logs out.

Here's an example:

// set default to something low app.use(session({   resave: true,   saveUninitialized: true,   cookie: {     maxAge: 5 * 60 * 1000 // 5 minutes   },   secret: secrets.sessionSecret,   store: new MongoStore({     url: yourUrl,     auto_reconnect: true   }) }));  // on successful login,  // set expiration to null or something longer than default var time = 14 * 24 * 3600000; //2 weeks req.session.cookie.maxAge = time; req.session.cookie.expires = new Date(Date.now() + time); req.session.touch();  // on logout, reset expiration to something low   var time = 5 * 60 * 1000; // 5 minutes req.session.cookie.maxAge = time; //2 weeks req.session.cookie.expires = new Date(Date.now() + time); req.session.touch(); 

This is particularly useful when remote monitoring your app because if the monitoring is frequent enough, the sessions will fill up fast.

回答4:

You can always just catch the response headers event and remove the 'set-cookie' header:

app.use(function(req, res, next) {   res.on('header', function () {     if (req.headers.authorization) {       delete res._headers['set-cookie'];     }   });   next(); }); 

You can technically put this anywhere in your middleware chain.

文章来源: Prevent Expressjs from creating a session when requests contain an authorization header?