Express change session every request

Viewed 15843

I have a function to login

app.post('/doLogin', function(req,res){
        db.users.findOne({username: req.body.username}, function(err, user) {
            if( err ) {
                console.log("Login fail");
            } 
            else if (user != null) {
                if (req.body.password == user.password) {
                    req.session.user_role = "user";
                    req.session.save();
            } else {
                req.session.user_role = "null";
                console.log("Wrong login");
            }
        }
        res.send({redirect: "/"});
    });

});

This function is used to save a variable into session req.session.user_role = "user"; But when the new request to check user logged in or not

app.get('/', function(req,res){
    redis.get('sess:' + req.session.id, function(err, result){
        console.log("Get session: " + util.inspect(JSON.parse(result),{ showHidden: true, depth: null }));
    });
    if ((req.session.user_role == "user")) {
          console.log("Logged in");
    } else {
        console.log("Logged out");
    }
});

Then return always is "Logged out", because the session is changed. I use Redis to store session, I think it is Redis fault because when I stop using Redis, it's OK Please help me!

5 Answers

All answers so far are helpful but don't directly solve the issue with using secure:true.

In order to use secure:true you must have support for https for secure cookies. Additionally you must use withCredentials for cross-site access control. withCrendentials:true has no impact on same-site request.

https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials

Majority of libraries support this parameter in their configurations such as angular and dropzone.

Related