3 ms·
Show HN: Express-Session-JWT
- ecesena 5y agoAuthor here. We forked express-session to use JWT as session tokens and improve security [1, 2], notably: - Prevent session fixation (e.g., when a user logs in a new token is emitted) - Guarantee that destroyed sessions can't be re-saved (e.g., a logged out session can't become alive again) - Reduce the impact of data theft from the store (stores hash(sessId) instead of sessId) We put extra care on tests (well, as anyone should). This fork passes all tests of the original express-session and we added new tests to validate the new security guarantees. Feedback is very welcome. [1] https://supertokens.io/blog/express-session-vs-supertokens-for-handling-user-sessions?ref=hackernoon.com https://supertokens.io/blog/express-session-vs-supertokens-f... [2] https://hackernoon.com/secure-sessions-in-javascript-forking-express-session-to-improve-security-s62c35mk https://hackernoon.com/secure-sessions-in-javascript-forking...
- Chyzwar 5y agoI am not sure why people use express where there is better and maintained fastify https://www.fastify.io/ https://www.fastify.io/ https://github.com/fastify/fastify-jwt https://github.com/fastify/fastify-jwt
- ecesena 5y agoI'm a fan of Fastify too, but express-session has 4M downloads/mo. Enough to be worried, I think, and to merit a fork.