Cookie less version?

I have a cookie-less API (which uses JWT for authentication) for a single page app and need a session store for the passport-oauth1 module (unfortunately, that module requires a session store to work). I was wondering if I could instead base the session store on a req.query.session_id query parameter instead of storing the session id in a cookie. Is there any module that behaves like express-session but which will retrieve the session id from an url rather than a cookie?

[dougwilson]

Gotcha. So the main part of authentication / security would be in your JWT handling; a cookie-less version of this module wouldn’t help in that regard, as securing your JWT would end up falling to you a implementation-specific details. For example, JWTs can be constructed in any way, signed or not, encrypted or not, come in anywhere in a request, etc.

The main features this module provides on top of get/set on the session store in management mainly around cookies specifically – that when a cookie does not exist, it makes a new one, creates a new session, etc. Typically with these “cookie-less” flows like JWT, a request without a JWT is not just going to want to get a session created for it, it would typically be out-right rejected.

I believe there is another thread somewhere, and I will try and dig it up for you. I don’t think this was in that thread, but just a current thought: perhaps a req.session.load API would be added that would load up a specific session ID in which you can call after decoding your incoming JWT–I haven’t put a lot of thought into that, so take that just with a grain of salt on if it would work or not 😂

[jilvin]

@dougwilson Thanks for replying really fast. Appreciate it.

Yeah we were thinking of proceeding that way. But since this is one of the core part of our system as a whole we were thinking it would be better if we could use something really battle tested like express-session. We do not want to roll out creepy security bugs especially in something as critical as authentication. That’s why I was trying to integrate express-session together with jwt instead of cookies.

I hope you might be able to provide more insights regarding this. Thanks in advance.