Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: introduce boolean res.locals flag to bypass session reroll (used by session-sharing)

Browse Source 
The session reroll logic is still standard practice, but in some cases, it is not necessary or causes UX issues. An issue opened in session sharing (julianlam/nodebb-plugin-session-sharing#95) brought this to attention in that parsing the cookie to log in the user caused a reroll (as expected), but caused the session open on other tabs to be mismatched. If "re-validate" was turned on, it basically meant that it was not possible to use NodeBB with multiple tabs.

Session sharing now sets `reroll` to `false` if re-validate is enabled.
This commit is contained in:
Julian Lam
2021-06-04 11:34:49 -04:00
parent 6632b2b6c3
commit 816856b0c6
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/controllers/authentication.js
View File

@@ -326,6 +326,9 @@ authenticationController.doLogin = async function (req, uid) {
return; return;
} }
const loginAsync = util.promisify(req.login).bind(req); const loginAsync = util.promisify(req.login).bind(req);
const { reroll } = req.res.locals;
if (reroll !== false) {
const regenerateSession = util.promisify(req.session.regenerate).bind(req.session); const regenerateSession = util.promisify(req.session.regenerate).bind(req.session);
const sessionData = { ...req.session }; const sessionData = { ...req.session };
@@ -333,6 +336,7 @@ authenticationController.doLogin = async function (req, uid) {
for (const [prop, value] of Object.entries(sessionData)) { for (const [prop, value] of Object.entries(sessionData)) {
req.session[prop] = value; req.session[prop] = value;
} }
}
await loginAsync({ uid: uid }); await loginAsync({ uid: uid });
await authenticationController.onSuccessfulLogin(req, uid); await authenticationController.onSuccessfulLogin(req, uid);