CODEWITHSUNDEEP
node.jsexpressnode.js-connect
anderswelt
anderswelt

Reputation: 1532

How to avoid sessions until logged in within Express

I cannot seem to figure a way to prevent Express/Connect from creating sessions until I have a valid log in from the user.

The problem especially arises when using a DB-Backed Session Storage and calling the REST Services from non-browsers as in such cases, the Connect Session Object will create a new Session for each request which I do of course want to prevent.

However, I do need sessions whenever the user is authenticated as I am using Passport.js for authentication which requires sessions as well as I do require it to load session data from sent cookie information.

Looking at the source of the Connect Session Code, it seems it is always creating a new Session if none got sent from client without any option to prevent it?

Upvotes: 2

Views: 229

Answers (1)

Richard Marr
Richard Marr

Reputation: 3064

If you can easily identify calls to your API at query time you could do something like this:

app.use(function(req, res, next){
    if ( req.path.indexOf("/api") == 0 ) return next();
    else return express.session()( req, res, next );
});

This way the session middleware is only included if the request URL doesn't match some condition. I haven't tried this in anger though, so you might want to consider initialising express.session() outside the function, and make sure there aren't any other repercussions.

Upvotes: 1

Related Questions