我有一个明确的应用程序,我试图将会话cookie设置为安全。到目前为止,我已尝试过以下代码:
app.use(express.cookieParser());
sessionOptions = definitions.REDIS;
sessionOptions.ttl = definitions.session.expiration;
app.use(express.session({
secret: definitions.session.secret,
cookie: { <---------------------------- Added this
secure: true
},
store: new RedisStore(sessionOptions)
}));
app.use(passport.initialize());
app.use(passport.session());
app.use(express.bodyParser());
app.use(express.csrf());
app.use(function(req, res, next) {
res.locals.token = req.session._csrf;
return next();
});
但是现在当我尝试登录CSRF令牌时没有验证,我得到一个禁止的错误。如何使会话cookie安全并使用CSRF令牌?
答案 0 :(得分:0)
这是我使用的。我认为您return
之前不需要next()
,但我不确定这是否是您的问题。
app
.set('view engine', 'jade')
.set('views', __dirname + '/../views')
.set('json spaces', 2)
.use(express.compress())
.use(express.cookieParser('our secret'))
.use(express.session({
store: new RedisStore({
port: config.redisPort,
host: config.redisHost,
db: config.redisDatabase,
pass: config.redisPassword
}),
proxy: true,
cookie: { httpOnly: true, secure: true }
}))
.use(express.bodyParser())
.use(express.methodOverride())
.use(express.csrf())
.use(function (req, res, next) {
res.cookie('XSRF-TOKEN', req.csrfToken());
res.locals.csrftoken = req.csrfToken();
next();
})
.use(everyauth.middleware());
Heroku需要proxy: true
。请注意,req.session._csrf
已在最新版本的Express中废弃。