httpsession/index.js

http middlewares session

/*global require,exports*/
/********************************************************************
 * Copyright (C) 2017. All Rights Reserved.
 *
 * @author haiyang5210
 * @date 2017/12/09
 *
 ********************************************************************
 */

'use strict'
var AesCtr = require('./lib/aes-ctr')

var session = {}
session.get = function(sessionKey, req) {
  var cookies = req.cookies
  if (!cookies) return null

  var str2 = AesCtr.decrypt(cookies[sessionKey] || '', session.secret, 256)
  
  return str2
}

session.maxAge = parseInt(1000 * 60 * 30)
session.httpOnly = true
session.secret = 'idcard@a.com'
// session.domain = 'localhost'

session._createIdentSession = function(req, res, uid, token, for2week) {
  var value = [
    uid,
    token,
    new Date().getTime(),
    for2week ? 'true' : ''
  ].join('|')

  var maxAge = session.maxAge
  if (for2week) maxAge = parseInt(24 * 60 * 60 * 1000 * 14, 10)

  var str = AesCtr.encrypt(value.toString(), session.secret, 256)
    // sessionID => token + 首次时间 + 上次时间
    // 首次时间超过一天强行销毁session
    // 上次时间超过半小时，强行销毁session，未超过半小时自动延后半小时
  res.cookie('SESSIONID_MD5', str, {
    maxAge: maxAge,
    httpOnly: session.httpOnly,
    domain: session.domain || req.header('host').split(':')[0] //设置domain 共享当前域下面登录状态
  })
  
  req.sessionStore = {
    uid: uid,
    token: token
  }
}

session._parseSession = function(req, res, next) {
  console.log('-----------httpsession/index.js => req.cookies[\'SESSIONID_MD5\']------------', req.cookies['SESSIONID_MD5'])
  var sessionStr = AesCtr.decrypt(req.cookies['SESSIONID_MD5'] || '', session.secret, 256)
  // var sessionStr = session.get('SESSIONID_MD5', req) || '' // session 取有点问题，待排查!!
  // console.info(sessionStr)
  req.sessionStore = {
    uid: '',
    token: ''
  }
  var arr = sessionStr.split('|')
  if (arr.length !== 4) {
    if (req.body) {
      req.body.token = ''
    }

    return next()
  }

  var uid = arr[0]
  var token = arr[1]
  var signinTime = arr[2]
  var for2week = arr[3]

  //校验两周登陆
  if (for2week) { /* Do nothing */ } else {
    //滑动过期
    session._createIdentSession(req, res, uid, token)
  }
  if (req.body) {
    //将token传递到API代理req中
    req.body.uid = uid;
    req.body.token = token;
  }

  req.sessionStore = {
    uid: uid,
    token: token
  }

  return next()
}

session._clearSession = function(req, res, next) {
  res.clearCookie('SESSIONID_MD5', {
    domain: session.domain || req.header('host').split(':')[0]
  })
}

session.config = function(conf) {
  if (conf.maxAge !== undefined) session.maxAge = conf.maxAge
  if (conf.httpOnly !== undefined) session.httpOnly = conf.httpOnly
  if (conf.secret !== undefined) session.secret = conf.secret
  if (conf.domain !== undefined) session.domain = conf.domain
}

module.exports = {
  config: session.config,
  get: session.get,
  _createIdentSession: session._createIdentSession,
  _parseSession: session._parseSession
}

/*
一、创建及读取 SESSIONID_MD5
var session = require('httpsession')

//用于从SESSIONID_MD5中解密uid，token
session._parseSession(req)
console.log(req.sessionStore)

// 创建 session
var uid = 100001, token = '27y72ge3gygh1'
session._createIdentSession(req, res, uid, token, false)


二、在 Express 中使用httpsession
app.use(require('httpsession')._parseSession)
app.all('/read', function(req, res) {
  res.send(req.sessionStore)
})
app.all('/login', function(req, res) {
  var uid = 100001, token = '27y72ge3gygh1'
  session._createIdentSession(req, res, uid, token, false)
  res.send('ok')
})
*/