Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@telegraf/session
Advanced tools
@telegraf/session
This package provides official storage adapters for Telegraf v4.12+ sessions [see motivation].
[!WARNING] You're not meant to import the default path! Read one of the following sections before using this module.
An in-memory session module is bundled with Telegraf. The following modules are available here:
Install the official Redis driver alongside this module.
npm i @telegraf/session redis
Usage is pretty straightforward:
import { Redis } from "@telegraf/session/redis";
const store = Redis({
url: "redis://127.0.0.1:6379",
});
const bot = new Telegraf(token, opts);
bot.use(session({ store }));
// the rest of your bot
To reuse an existing Redis client, use Redis({ client })
instead.
Install the official MongoDB driver alongside this module.
npm i @telegraf/session mongodb
Usage is pretty straightforward:
import { Mongo } from "@telegraf/session/mongodb";
const store = Mongo({
url: "mongodb://127.0.0.1:27017",
database: "telegraf-bot",
});
const bot = new Telegraf(token, opts);
bot.use(session({ store }));
// the rest of your bot
To reuse an existing MongoDB client, use Mongo({ client })
instead.
Install the Better-SQLite3 driver and types alongside this module.
npm i @telegraf/session kysely better-sqlite3
npm i --save-dev @types/better-sqlite3
Usage is pretty straightforward:
import { SQLite } from "@telegraf/session/sqlite";
const store = SQLite({
filename: "./telegraf-sessions.sqlite",
});
const bot = new Telegraf(token, opts);
bot.use(session({ store }));
// the rest of your bot
To reuse an existing Better-SQLite3 database instance, use SQLite({ database })
instead.
Install the 'pg' PostgreSQL driver and types alongside this module.
npm i @telegraf/session kysely pg
npm i --save-dev @types/pg
Usage is pretty straightforward:
import { Postgres } from "@telegraf/session/pg";
const store = Postgres({
host: "127.0.0.1",
database: "telegraf-test",
user: "database-user",
password: "hunter2",
});
const bot = new Telegraf(token, opts);
bot.use(session({ store }));
// the rest of your bot
To reuse an existing pg pool, use Postgres({ pool })
instead.
Install the 'mysql2' MySQL driver alongside this module.
npm i @telegraf/session kysely mysql2
Usage is pretty straightforward:
import { MySQL } from "@telegraf/session/mysql";
const store = MySQL({
host: "127.0.0.1",
database: "telegraf-test",
user: "database-user",
password: "hunter2",
});
const bot = new Telegraf(token, opts);
bot.use(session({ store }));
// the rest of your bot
To reuse an existing MySQL2 pool, use MySQL({ pool })
instead.
Since telegraf#1372, it has been known that all asynchronous session middleware have been prone to race-conditions. This was addressed in telegraf#1713, but third-party session middleware continue to be affected. Since Telegraf 1.12.0, it's recommended that third-party plugins only provide the store parameter for session, instead of implementing session themselves. This way, they can take advantage of the safety provided by Telegraf's builtin session. Of course, if your plugin has an exceptional usecase, it may need to implement its own middleware.
To begin to solve this problem, we officially maintain the 5 most common storage backends. This package is considered beta, and may have minor breaking changes and bugfixes before a semver stable release. Feedback is welcome via issues and in the group: TelegrafJSChat
FAQs
Session store adapters for Telegraf
We found that @telegraf/session demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.