Answer the question
In order to leave comments, you need to log in
How to check sessions for authenticity?
Just got into sessions.
I use express-sessions
.
Here is stored sid on the client. Through the post data comes from the authorization form. Then, according to the data searched in the database, a user with such a login is searched, if he finds it, it is saved req.session.save()
.
But the question gnaws, if somehow there is a session substitution, then how to check. There was an idea to check whether there is such a session in the storage for each request to the site.
In my opinion a simple check if(req.session.sid)
is not a good idea. It's just checking the existence of a session, but not its authenticity, and each time connecting to the database, comparing is expensive.
But the question is, maybe there are simpler and faster methods? Maybe there are some built-in mechanisms?
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question