8

I'm using a Node.js server and I'm developing with the Connect framework. I'm trying to regenerate SIDs after a given interval to avoid session fixation. There's a method called req.session.regenerate which, according to the docs, should do just that.

« To regenerate the session simply invoke the method, once complete a new SID and Session instance will be initialized at req.session »

Example code:

req.session.regenerate(function(err){
    // will have a new session here
 });

After calling the above method, I check the value of req.sessionID, only to find that the value is the same as before.

If I try to get the sessionID from within req.session.regenerate and write it to the terminal I get a new SID, which is even more perplexing ~ I.E why would you want the SID generated only within the scope of the callback? If I assign the value to a global variable, it's value is undefined.

I've a feeling that it's something really obvious that I'm overlooking.

Any help is appreciated.

aynber
  • 22,380
  • 8
  • 50
  • 63
J. Michael Wilson
  • 504
  • 5
  • 5
  • 1
    Where/when are you checking `req.sessionID`? Maybe the code you're checking with is actually checking before the regenerate function runs. – Chris W. Mar 10 '11 at 22:13
  • I've been checking in a few places. Before, from within, and after regenerate to compare the values. I use console.log to send the value of req.session.id to the terminal. And there's no difference in them. – J. Michael Wilson Mar 11 '11 at 03:21
  • did you fix this ? I'm having another slightly different issue : http://stackoverflow.com/questions/5646905/why-do-i-have-to-create-a-local-reference-to-a-request-session-object-in-nodejs – Lewis Apr 13 '11 at 10:24

2 Answers2

2

Just send the response back in the callback of the regenerate function. Since the session regeneration is async, when you return to the client it will still have the older session. 

req.session.regenerate(function(err) {
                                req.session.myid = "myvalue";
                                res.simpleJSON(200, status);
                        });
baradas
  • 454
  • 1
  • 5
  • 14
1

In all likelihood your problem is related to this issue:

https://github.com/senchalabs/connect/pull/263

In any case, the behavior you describe is exactly the same as reported in the issue.

Steven Devijver
  • 2,553
  • 1
  • 22
  • 22