Not cookie based session management in node.js

I am looking for a non-cookie based session management in node.js, something like pass a parameter in the URL like &session_id=. It will know that a session has expired when a request comes with an session_id. I've looked at connect library, but it looks that it is cookie based only.

Warning

Passing the session id as a GET parameter is considered bad practice. Why? It is dangerous because people don't usually care about session id and they will probably publish/share links with their session ids inside.

It's also a problem because when a user clicks an external link on your web, and goes to another site, that new site will be able to see the session_id in the referrer link.

So I don't think it is a good idea. Cookies are more secure.

Have a look at: Session Hijacking

For every request you receive, you will get all of the client cookies accordingly. You can also set client cookies in the response HTTP headers using "Set-Cookie."

Using a GET parameter is unsafe. Any user could accidently share their session ID, but if you want 100% security, I'd share session IDs via cookies, and I would use HTTPS to prevent snoopers from stealing cookies.

You can use localstorage or sessionStorage..

  • almost same as cookie
  • not a cookie
  • better than a cookie!

More info: https://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Storage

It's very -very- easy to use... in Js for example: 

<script>
    // check if Storage is avaible
  if(typeof(Storage)!=="undefined") {
    // Save data to local storage (no exiparion date)
    localStorage.setItem("name_always", "bxx");
    // Save data to the current session (removes when the tab is closed)
    sessionStorage.setItem("name_now", "bxx");
  } else {
    // No Storage support...
  }
  // Access to stored data
  alert( "For only now, my name is: " + sessionStorage.getItem("name_now"));
  alert( "Every day, my name is: " + localStorage.getItem("name_always"));
</script>

Tags:

You can use sessions with a store in node.js. For example, you have express application and want to use session like system in your webapp. You can use connect-mongo module for this. This will let you store your session in db. In your app.js

var express = require('express'),
    , mongoStore = require('connect-mongo')(express);

var app = express();

app.configure('all', function () {
    app.use(express.session({
        secret: "terces",
        cookie: { maxAge: 24 * 60 * 60 * 1000 },
        store: new mongoStore({
            url: your_db_url
        })
    }));
    app.use(function(req, res, next) {
        res.locals.session = req.session;
        next();
    });
});

With basic code above, you have session in express that you can use it in your controllers and views directly. In your controller;

app.post('/blog/create/?', function(req, res, next) {
    if (!req.session.user) {
        next("You need to login in order to create blog!");
    }
});

In your view, you can use session.user in order to generate profile menu for example.