Sessions nodejs with socket.io - node.js

I need to do sessions with nodejs, but using socket.io ..
I have this functional code, which works with the get method
var express = require('express')
var session = require('express-session')
var app = express()
app.use(session({
secret: 'keyboard cat',
resave: true,
saveUninitialized: true,
cookie: { maxAge: 28800000 }}))
app.get('/', function(req, res, next) {
var sess = req.session
if (sess.views) {
sess.views++
res.setHeader('Content-Type', 'text/html')
res.write('<p>views: ' + sess.views + '</p>')
res.end()
console.log(sess.views)
} else {
sess.views = 1
res.end('welcome to the session demo. refresh!')
console.log(sess.views)
}
})
console.log('Server iniciado y operando!')
app.listen(3000)
But I need sessions using this method
var express = require('express');
var app = express();
var server = require('http').Server(app);
var io = require('socket.io')(server);
app.use(express.static('client'));
var messages = [{
id: 1,
text: 'Bienvenido al chat privado de Socket y Node de Luis Zurita',
nickname: 'BELICOFSA dice:'
}];
io.on('connection', function(socket){
console.log("El equipo con IP: "+socket.handshake.address+" se ha conectado...");
socket.emit('caja-chat', messages);
socket.on('add-message', function(data){
messages.push(data);
io.sockets.emit('caja-chat', messages);
});
});
server.listen(3000, function(){
console.log('Servidor esta Funcionando en http://localhost:6677');
});
What I have done best is this, but it does not work as code 1
can you help me?
var express = require('express')
var app = express()
var server = require('http').Server(app);
var ios = require('socket.io-express-session');
var io = require('socket.io')(server);
var Session = require('express-session');
var session = Session({
secret: 'sdfgf',
resave: true,
saveUninitialized: true,
cookie: { maxAge: 100000 }
});
var messages = [{
id: 1,
text: 'Bienvenido al chat privado de Socket y Node de Luis Zurita',
nickname: 'BELICOFSA dice:'
}];
server.listen(3000, function(){
console.log('Servidor esta Funcionando en http://localhost:6677');
});
io.use(ios(session));
app.use(express.static('client'));
io.on('connection', function(socket){
socket.handshake.session.save;
var sess = socket.handshake.session;
if (sess.views) {
sess.views++
} else {
sess.views = 1
}
console.log(sess);
socket.emit('caja-chat', messages);
socket.on('add-message', function(data){
messages.push(data);
io.sockets.emit('caja-chat', messages);
});
});

Related

Protection csrf Nodejs Form

I have a little probleme with my Nodejs application. I want protect my forms with csrf token, but it's not work. I have an error like
ForbiddenError: invalid csrf token
POST http://localhost:3000/addfile 403 (Forbidden)
I want to create csrf token for all requests. I can create csrf token, but if I use the methods like : POST/PUT or DELETE it's not work.
I don't understand why I have this error. Thanks for yours answers.
app.js
var express = require("express");
var bodyParser = require("body-parser");
var mongoose = require('mongoose');
var fs = require('fs');
var path = require('path');
var logger = require('morgan');
var expressValidator = require('express-validator');
var csrf = require('csurf');
var session = require('express-session');
var passport = require('passport');
var PORT = 3000;
var config = require('./config/database');
var app = express();
// Connexion to MongoDb
mongoose.connect(config.database, function(err) {
if(err){
console.log(err);
}
else{
console.log("Connected to MongoDb");
}
});
// Middleware
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(expressValidator());
app.set('views',path.join(__dirname, ''));
app.set('view engine','pug');
app.use(express.static(path.join(__dirname, '')));
app.disable('x-powered-by');
app.use(session({
name: 'SESS_ID',
secret: config.secret,
resave: true,
saveUninitialized: true,
cookie: {
secure: false,
httpOnly: true,
maxAge: 5*60*1000 } //15minutes*60sec*1000ms
//cookie: {secure: false} //https = true, http=false
}));
app.use(csrf());
app.use(passport.initialize());
app.use(passport.session());
require('./config/passport')(passport);
app.use(function(req, res, next) {
res.locals._csrf = req.csrfToken();
next();
});
app.use('/', require('./routes/fileRoutes'));
app.use('/', require('./routes/authRoutes'));
app.listen(PORT,function(){
console.log("Server started at the port " + PORT);
});
routes/fileRoutes.js
app.get('/',function(req,res){
File.find(function(err, files){
res.render('views/layout',{files:files});
});
});
app.post('/addfile',upload,function(req,res){
if (req.fileValidationError) {
return res.end("Error PDF");
} else {
for (var i = 0; i < req.files.length; i++)
{
var files = new File ();
files.fieldname= req.files[i].fieldname;
files.originalname= req.files[i].originalname;
files.encoding= req.files[i].encodin;
files.path= req.files[i].path;
files.save(function(err, data){
});
}
res.redirect('/');
}
});
layout.pug
form#uploadForm(enctype='multipart/form-data', action='/addfile', method='post')
input(type='hidden', name='_csrf', value=_csrf)
input(type='file', name='userPhoto', multiple='')
input(type='submit', value='Upload Image', name='submit')
input#random(type='text', name='random')
I see you have:
input(type='hidden', name='_csrf', value=_csrf)
What is the value for if you console.log(_csrf)? I also noticed you didn't put that one in quotes.

Cannot connect redisStrore to express-session

Code:
Express.js
'use strict';
module.exports = function(app, io, server) {
var express = require('express');
var bodyParser = require('body-parser');
var methodOverride = require('method-override');
app.use(bodyParser.json({ type: 'application/vnd.api+json' }));
app.use(bodyParser.urlencoded({ extended: true }));
app.use(methodOverride('X-HTTP-Method-Override'));
// Redis
const redis = require('./utils/redis.js')();
app.set('redis', redis);
let isSessionCreated = false;
app.use('*', (req, res, next) => {
if(!isSessionCreated) {
isSessionCreated = true;
require('./middleware/sessionConfig.js')(app);
next();
}
});
// Passport
require('./middleware/passport.js')(app);
// Start Socket
require('./middleware/startSocket')(app, io);
app.use(express.static(__dirname + '/public'));
app.use(express.static(__dirname + '/dist'));
// Start Webpack
require('./webpack/startWebpack.js')(app);
// routes ==================================================
require('./routes/routes')(app); // configure our routes
require('../config/webpack.dev.js');
}
redis.js
'use strict';
const redis = require('redis'),
session = require('express-session'),
redisStore = require('connect-redis')(session),
redisClient = redis.createClient(),
uuid = require('uuid'),
cookieParser = require('cookie-parser');
module.exports = function() {
console.log('Redis started');
// Connects to Redis Store
const sessionStore = new redisStore({
host: '127.0.0.1',
port: 6379,
client: redisClient,
ttl : 3600000
});
redisClient.on('error', (err)=> {
console.log('could not connect ', err);
});
// Checks for Redis Connection
redisClient.on('connect', ()=> {
console.log('redis connected');
});
return {
set: function(obj) {
console.log('set called: ', obj);
redisClient.set(obj.id, obj.token);
},
sessionStore
}
}
sessionConfig.js
'use strict';
module.exports = function(app) {
const cookieParser = require('cookie-parser'),
session = require('express-session'),
uuid = require('uuid');
// Sets up Express Session
app.use(cookieParser());
console.log('session created');
let redis = app.get('redis');
app.use(session({
name: 'irelief',
secret: 'irelief',
store: redis.sessionStore,
cookie: {
cookieName: 'xyz',
httpOnly: false,
secret: 'irelief',
secure: false,
maxAge: 360000000
},
genid: function(req) {
return uuid.v4();
},
saveUninitialized: false,
resave: true,
rolling: true
}));
}
OUTPUT OF req.session on app.get('/', (req, res))
session: Session {
cookie:
{ path: '/',
_expires: 2017-07-30T22:38:34.653Z,
originalMaxAge: 360000000,
httpOnly: false,
cookieName: 'xyz',
secret: 'irelief',
secure: false } }
I have tried all that was said across any communities, nothing helps so far.
The same problem persists with passport.js
Any help will be awesome

express-session, read vars on socket.io interaction

I am making a chat for customers of a web page, with express.js, and socket.io, and I'm trying to manage sessions with express-session, my problem is, how do I read the session values on the socket.
Here's part of my code.
Thanks for the help :)
var express = require('express');
var app = express();
var http = require('http').Server(app);
var io = require('socket.io')(http);
var bodyParser = require('body-parser');
var session = require('express-session');
var shortid = require('shortid');
app.use(express.static('public'));
app.use( session({
secret: 'dont move',
resave: true,
saveUninitialized: true
})
);
app.use( bodyParser.urlencoded({ extended: true }) );
app.post('/chat', function(req, res){
var sess = req.session;
sess.ssid = shortid.generate();
res.render('chat', { name: "name" });
});
io.on('connection', function(socket){
socket.on('chat message', function( data ){
if( data.msg.trim() != '' ){
console.log('message: ' + data.msg);
//Here I want to read the ssid session var, so I can manage many chats at the same time
}
});
socket.on('disconnect', function(){
console.log('Hey, someone disconected!');
});
});
http.listen(3000, function(){
console.log('listening on *:3000');
});
You can configure socket authorization
var express = require('express');
var app = express();
var http = require('http').Server(app);
var io = require('socket.io')(http);
var bodyParser = require('body-parser');
var session = require('express-session');
var shortid = require('shortid');
app.use(express.static('public'));
app.use( session({
secret: 'dont move',
resave: true,
saveUninitialized: true
})
);
app.use( bodyParser.urlencoded({ extended: true }) );
app.post('/chat', function(req, res){
var sess = req.session;
sess.ssid = shortid.generate();
res.render('chat', { name: "name" });
});
var util = require('util';
var connect = require('connect');
var parseSignedCookie = connect.utils.parseSignedCookie;
io.configure(function () {
io.set('authorization', function (data, callback) {
if(data.headers.cookie) {
data.cookie = cookie.parse(data.headers.cookie);
data.sessionId = parseSignedCookie(data.cookie['ssid'], 'dont move');
}
callback(null, true);
});
io.on('connection', function(socket) {
var sessionId = socket.handshake.sessionId;
socket.on('chat message', function( data ){
if( data.msg.trim() != '' ){
console.log('message: ' + data.msg);
// NOW YOU CAN USE `sessionId`
}
});
socket.on('disconnect', function(){
console.log('Hey, someone disconected!');
});
});
});
http.listen(3000, function(){
console.log('listening on *:3000');
});

MongoDB not reflecting written entries from Node.js

I am implementing a MongoStore for use in session storage within my Node.js/Express application, however it looks as if none of the sessions are actually being stored in the database. (The MongoDB does not even have the db.session).
Socket.io 'authorization' takes the incoming data, and crosschecks the sent sessionID, however it keeps returning empty.
Hope someone could shed some light on any issues?
var express = require('express');
var bodyParser=require('body-parser');
var cookieParser = require('cookie-parser');
var session = require('express-session');
var MongoStore = require('connect-mongo')(session);
var utils = require("express/node_modules/connect/lib/utils");
var parseSignedCookie = utils.parseSignedCookie;
var cookie = require('cookie');
var app = express();
app.use(bodyParser());
app.use(cookieParser());
var sessionStore = new MongoStore({
db: 'express',
host: 'localhost',
port: 27018,
collection: 'session',
auto_reconnect:true
});
app.use(session({
cookie: { maxAge: 5000 } ,
secret: "session secret",
store: sessionStore
}));
function checkSession(req,res,next){
if(req.session.user){
next();
}
else {
req.session.error = "Get Outta here!";
res.redirect('/');
}
}
app.get('/', function(req, res){
res.sendfile('./index.html');
});
app.post('/',function(req,res){
if(req.body.name){
req.session.user=req.body.name;
res.redirect('/info');
}
else {
req.session.error = "Auth Failure";
res.redirect('back');
}
});
app.get('/info', checkSession, function(req,res){
if(req.headers.cookie){
var session_id = utils.parseSignedCookie(req.headers.cookie, 'session secret');
console.log(session_id);
console.log("true");
res.sendfile('./info.html');
}
else {
console.log("false");
res.redirect('/');
}
});
var http = require('http').Server(app);
http.listen(80, function(){
console.log('listening on *:80');
});
var io = require('socket.io').listen(http);
You're not using your sessionStore anywhere. Try this:
app.use(session({
store: sessionStore,
cookie: { maxAge: 5000 } ,
secret: "session secret"
}));

expressjs and socket.io session issues

I'm using express and socket.io and I want to share the express session between the two, with each one being on a different Node instance (localhost:3000 and localhost:8000). So far, express will create the session and the cookie created, however socket.io only picks up the 'io' cookie, not the express cookie. Can anyone show mw here my error is? I'm using express 4.x and socket.io 1.x.
Express config (localhost:3000):
var cookieParser = require('cookie-parser')
, session = require('express-session')
, bodyParser = require('body-parser')
, express = require('express')
, redis = require('redis')
, RedisStore = require('connect-redis')(session);
module.exports = function (app, passport) {
app.use(express.static('./static'))
app.use(cookieParser("thisismynewsecret"));
app.use(session({
//passport: passport,
name: 'sid',
//key: 'express.sid',
secret: 'thisismynewsecret',
saveUinitialized: true,
resave: true,
store: new RedisStore({ client: redis.createClient() }),
cookie: {
httpOnly: true,
path: '/',
secure: false
}
}));
app.use(passport.initialize());
app.use(passport.session());
// all environments
app.set('port', process.env.PORT || 3000)
app.set('views', './views')
app.set('view engine', 'jade')
app.use(bodyParser.json());
app.use(bodyParser.urlencoded());
app.use(require('method-override')());
app.use( require('express-subdomain-handler')({ baseUrl: 'localhost', prefix: 'myprefix', logger: true }) );
}
});
socket.io (localhost:8000):
var fs = require('fs');
var session = require('express-session');
var cookie = require('cookie');
var cookieParser = require('cookie-parser');
var sessionStore = require('connect-redis')(session);
var server = require('http').Server(function(req, res) {
fs.readFile(__dirname + '/views/JAMinit.html', function(error, content) {
if (error) {
res.writeHead(500);
res.end();
}
else {
res.writeHead(200, { 'Content-Type': 'text/html' });
res.end(content, 'utf-8');
}
});
}).listen(8000);
var io = require('socket.io')(server);
io.use(function(socket, next) {
var data = socket.handshake || socket.request;
if (data.headers.cookie) {
data.cookie = cookie.parse(cookieParser.signedCookie(data.headers.cookie, 'thisismynewsecret'));
console.log(data.cookie);
console.log('data.cookies ( %s )', JSON.stringify(data.cookie));
if (data.cookie.sid) {
data.sid = data.headers.cookie.sid;
sessionStore.get(data.headers.cookie.sid, function(err, session) {
data.session = session;
});
}
}
next();
});
Check out express.io, it combines express and socket.io and has automatic session support.

Resources