nodejs, create session only after successful authentication in express

Question

nodejs, create session only after successful authentication in express

I have a requirement to create a session only after successful authentication. I was able to create redisStore based session using express middleware, but it creates session when the first request comes to server. But how I can create session only after successful authentication. I googled somewhat, and found req.session.regenerate() (but I found the issue as below mentioned in this thread: Regenerate session IDs with Nodejs Connect)

But in regenerate case also, it creates a fresh one, assuming old one is created already, and is created with same parameter.

So there is any other way to create a new session ID only after successful authentication.

Thanks for your help in advance.

node.js
authentication
sessionid

Answer 1

You may be conflating the idea of a session with the idea of an authenticated session.

It's normal for all users to have a session - even the anonymous, not-yet-logged-in users. The difference between this and an authenticated session is just that, locally on your web server, you specify that a particular user has been authenticated.

For example, once you authenticate someone, you can set:

req.session.isAuthenticated = true;

Then, when rendering pages, your controllers can do something like

function(req, res, next) {
  if (!req.session.isAuthenticated) return res.redirect('/login');
  res.render('appPage');
}