plugin-session

The session plugin is used to enable session support in your application. It will use the specified store as the session storage mechanism and extend the default thorin action with additional functionality.

Installation and usage

npm i --save thorin-plugin-session@1.x
'use strict';
// app.js entry file
const thorin = require('thorin');

thorin.addPlugin(require('thorin-plugin-session'));   // <- add this line
thorin.run((err) => {});

#update config/app.js with your configuration
# run to setup the store
node app.js --setup=plugin.session

Default configuration

• storestringthe default store to use for persisting session information, see bellow additional info.
• cookiePrefixstringif specified, the cookie key will have this prefix (eg: sess-qejkwjkernjkwnrjk)
• cookieNamestring, tpsthe cookie name, used in Set-Cookie header.
• secureboolean, false set to true to enable secure https-only cookies.
• encryptboolean, true setting this to true will encrypt the contents of the session. By default, the session JSON is stored in plaintext.
• authorizationboolean, true should the plugin add itself as an authorization source? This will attach the plain session id to intentObj.authorization and set the intentObj.authorizationSource to SESSION , if found empty
• secretstringthe secret key used to sign the cookie id. This should differ from one app to another
• expirenumber, 86400the number of seconds until a session expires.
• namespacestring, sessionthe name of the namespace that will be used by the store, to save sessions.

Store configuration

• store = file saves all the sessions using the file system, under the configured opt.path directory (defaults thorin.root + /sessions). This should be used in development mode.
• store = redis saves all the sessions inside the specified redis store. This can also be the name of the store instance (eg, redis-session). All sessions will be stored using the configured namespace with the help of GET, SETEX, DEL,
• store = sql saves all the sessions to the SQL database, using the opt.namespace as the sessions table name.

The stores will never store the actual session id set in the Set-Cookie header, but rather use the sha2 hash mechanism to hash them. When we check if a session exists, we hash the id and check if the hash exists. This mechanism makes it hard for any malicious user to use the session storage to impersonate users by using their session ids, since these ids are never in plain text.

Using the plugin with encrypt=true takes the security concerns to the next level. Before we store the session content (the JSON) to the specified store (file, sql, redis), we encrypt its content with the plaintext session id. This way, only users that posses the session id have access to the session's content.
A small proof of concept can be viewed bellow

'use strict';
let sessionId = thorin.util.randomString(32);   // let this be the generated session id.
let sessionData = {
   "someSession": "data right",     // let this be the session content
   "here": true
}
let storedSessionHash = thorin.util.sha2(sessionId),
   storedSessionData = thorin.util.encrypt(JSON.stringify(sessionData), sessionId);
save(storedSessionHash, storedSessionData) // Store the hashed & encrypted session information.

Plugin functionality

Extended thorin.Intent

'use strict';
thorin.dispatcher
   .addAction('my.action')
   .use((intentObj, next) => {
      if(!intentObj.session.value) {
         log.info('New session was just created');
         intentObj.session.value = "Hello world";
      }
      next();
   });

thorin.dispatcher
   .addAction('account.logout')
   .use((intentObj, next) => {
      intentObj.session.destroy();
      next();
   });

The SessionData class

The SessionStore class

We currently offer a wrapper for file, redis, sql. If you want your own session store, make sure it implements the following functionality.