Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@evansolomon/connect-pg-simple
Advanced tools
A simple, minimal PostgreSQL session store for Connect/Express
A simple, minimal PostgreSQL session store for Express/Connect
npm install connect-pg-simple
Once npm installed the module, you need to create the session table in your database. For that you can use the [table.sql] (https://github.com/voxpelli/node-connect-pg-simple/blob/master/table.sql) file provided with the module:
psql mydatabase < node_modules/connect-pg-simple/table.sql
Or simply play the file via a GUI, like the pgAdminIII queries tool.
Examples are based on Express 4.
Simple example:
var session = require('express-session');
app.use(session({
store: new (require('connect-pg-simple')(session))(),
secret: process.env.FOO_COOKIE_SECRET,
cookie: { maxAge: 30 * 24 * 60 * 60 * 1000 } // 30 days
}));
Advanced example showing some custom options:
var pg = require('pg')
, session = require('express-session')
, pgSession = require('connect-pg-simple')(session);
app.use(session({
store: new pgSession({
pg : pg, // Use global pg-module
conString : process.env.FOO_DATABASE_URL, // Connect using something else than default DATABASE_URL env variable
tableName : 'user_sessions' // Use another table-name than the default "session" one
}),
secret: process.env.FOO_COOKIE_SECRET,
cookie: { maxAge: 30 * 24 * 60 * 60 * 1000 } // 30 days
}));
Express 3 (and similar for Connect):
var express = require('express');
app.use(session({
store: new (require('connect-pg-simple')(express.session))(),
secret: process.env.FOO_COOKIE_SECRET,
cookie: { maxAge: 30 * 24 * 60 * 60 * 1000 } // 30 days
}));
DATABASE_URL
environment variable (as you do by default on eg. Heroku) – then you need to specify the connection string or object here so that this module that create new connections. Needen even if you supply your own database module.session
, then you can specify that here.60
seconds. If set to false
no automatic pruning will happen. Automatic pruning weill happen pruneSessionInterval
seconds after the last pruning – manual or automatic.console.error()
, but can be useful to override if one eg. uses Bunyan for logging.3.0.0
, then the timers will block any graceful shutdown unless you tell the automatic pruning to stop by closing the session handler using this method.false
– which can be useful if one wants improved control of the pruning.pg
instance used is created by this module, then this module should also close it on close()
options.pruneSessionInterval
defined interval.close()
method – or by deactivating the automatic pruning by settinging options.pruneSessionInterval
to false
. If automatic pruning is disabled the client needs to call pruneSessions()
manually or otherwise ensure that old sessions are pruned.public
schema, as added in 2.2.0
, but rather default to the pre-2.2.0
behavior of no defined schema. This to ensure backwards compatibility with the 2.x
branch, per semantic versioning best practise.require('pg')
to match package.json, thanks for reporting @dmitriiabramovpg
dependency again rather than pg.js
as the latter will be discontinued as pg
now fills its roletableName
optionexpress.session
to the module rather than just express
.3.0.2
FAQs
A simple, minimal PostgreSQL session store for Connect/Express
We found that @evansolomon/connect-pg-simple demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.