CODEWITHSUNDEEP
node.jsexpresswebsocketsockjs
darwinbaisa
darwinbaisa

Reputation: 688

How can I get (Express's) sessionID for a SockJS connection

I am using SockJS on Express server. Is there any way to get the associate HTTP session ID of the client?

I see there is a way to do it for raw web socket and Socket.io, but I am struggling to find how to do it for SockJS.

This is how my server looks like. I want a similar handler to fetch session ID: 

var sockjs_echo = sockjs.createServer(sockjs_opts);
sockjs_echo.on('connection', function(conn) {
    conn.on('data', function(message) {
        conn.write(message);
    });
});

Upvotes: 2

Views: 1214

Answers (2)

Eric Twose
Eric Twose

Reputation: 173

Thanks so much for asking this question, @darwinbaisa, and for the answer, c-toesca. This came after days of searching.

For XHR streaming, the cookies are at: conn._session.recv.request.headers.cookie.

The only other way I could think of doing this was to make the express session cookie httpOnly: false, thus exposing it to javascript and, of course, the possibility of hacking, then pass it back as a prefix to any message from the SockJS javascript client to the node server.

Or to assign the ID to a javascript variable as I dynamically wrote a web page response, so that javascript would have access to the variable, and again could return it to the server. But again, this would have exposed the ID, and even if the ID was hashed or encrypted, it could still be used in a malicious call to the server from javascript.

Things like this are made a lot easier in the node WS library, but I need a fallback from that for websocket-challenged browsers.

Upvotes: 0

c-toesca
c-toesca

Reputation: 1007

This is a "hack", but it works for me:

sockjs_echo.on('connection', function(conn) {

        var cookieHeader = conn._session.recv.ws._stream._readableState.pipes._driver._request.headers.cookie
        var cookies = {}
        cookieHeader.split(';').forEach(function( cookie ) {
            var parts = cookie.split('=');
            cookies[parts.shift().trim()] = decodeURI(parts.join('='));
        });

        conn.on('data', function(message) {
            conn.write(message);
        });
    });

'cookies' variable (example):

{
  "dev_cookie": "1mimec6rbcolp0ujkcbqq9pdq4uoa5v0p8a284v32tmd4q3k0qi9p4vjteoifdn9b0lsm238fghf974o9jfehfuhvm3ltrgq02ad6k0",
  "session_cookie": "s%3AjkKYPKFFT8r60rXUsVYISoOF17o49GUl.pbpu6T1%2BcdrIu5uQPRxZUYOrl5GnC179GaI5pWyR7SA",
  "other_cookie": "s%3AzRMiC3fjo4gxTXX1p2XSi_C_EydIa358.KAdP1gwtZBVfcbkmwi%2B3pa0L1pbOCzQ3lHnNEyFvvHc"
}

Upvotes: 1

Related Questions