Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
connect-redis
Advanced tools
The connect-redis npm package is a Redis session store for Express and Connect. It allows you to store session data in a Redis database, which can help with scaling applications by providing a centralized session store.
Basic Setup
This code demonstrates how to set up a basic Express application with connect-redis as the session store. It configures the session middleware to use Redis for storing session data.
const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const express = require('express');
const app = express();
app.use(session({
store: new RedisStore({
host: 'localhost',
port: 6379
}),
secret: 'your secret',
resave: false,
saveUninitialized: false
}));
app.get('/', (req, res) => {
res.send('Hello World!');
});
app.listen(3000, () => {
console.log('Server is running on port 3000');
});
Custom Redis Client
This code demonstrates how to use a custom Redis client with connect-redis. This can be useful if you need to configure the Redis client with specific options or use an existing Redis client instance.
const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const express = require('express');
const redis = require('redis');
const app = express();
const redisClient = redis.createClient({
host: 'localhost',
port: 6379
});
app.use(session({
store: new RedisStore({ client: redisClient }),
secret: 'your secret',
resave: false,
saveUninitialized: false
}));
app.get('/', (req, res) => {
res.send('Hello World!');
});
app.listen(3000, () => {
console.log('Server is running on port 3000');
});
Advanced Configuration
This code demonstrates advanced configuration options for connect-redis, such as setting the time-to-live (ttl) for sessions and enabling error logging.
const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const express = require('express');
const app = express();
app.use(session({
store: new RedisStore({
host: 'localhost',
port: 6379,
ttl: 260,
logErrors: true
}),
secret: 'your secret',
resave: false,
saveUninitialized: false
}));
app.get('/', (req, res) => {
res.send('Hello World!');
});
app.listen(3000, () => {
console.log('Server is running on port 3000');
});
express-session is a general-purpose session middleware for Express. It supports various session stores, including in-memory, file-based, and database-backed stores. Unlike connect-redis, it does not provide a Redis-specific store out of the box but can be extended with other packages.
connect-mongo is a MongoDB session store for Express and Connect. It provides similar functionality to connect-redis but uses MongoDB as the backend store instead of Redis. It is useful for applications that already use MongoDB and want to keep session data in the same database.
express-mysql-session is a MySQL session store for Express. It provides similar functionality to connect-redis but uses MySQL as the backend store. It is useful for applications that use MySQL and want to store session data in a relational database.
connect-redis is a Redis session store backed by node_redis, and is insanely fast :). Requires redis >= 2.0.0
for the SETEX command.
npm install connect-redis express-session
Pass the express-session
store into connect-redis
to create a RedisStore
constructor.
var session = require('express-session');
var RedisStore = require('connect-redis')(session);
app.use(session({
store: new RedisStore(options),
secret: 'keyboard cat',
resave: false
}));
A Redis client is required. An existing client can be passed directly using the client
param or created for you using the host
, port
, or socket
params.
client
An existing clienthost
Redis server hostnameport
Redis server portnosocket
Redis server unix_socketurl
Redis server urlThe following additional params may be included:
ttl
Redis session TTL (expiration) in seconds. Defaults to session.cookie.maxAge (if set), or one day.
(store, sess, sessionID) => number
.disableTTL
Disables setting TTL, keys will stay in redis until evicted by other means (overides ttl
)db
Database index to use. Defaults to Redis's default (0).pass
Password for Redis authenticationprefix
Key prefix defaulting to "sess:"unref
Set true
to unref the Redis client. Warning: this is an experimental feature.serializer
An object containing stringify
and parse
methods compatible with Javascript's JSON
to override the serializer usedlogErrors
Whether or not to log client errors. (default: false
)
true
, a default logging function (console.error
) is provided.false
, no logging occurs.scanCount
Value used for count parameter in Redis SCAN
command (used in ids()
and all()
methods, defaults to 100).Any options not included in this list will be passed to the redis createClient()
method directly.
Clients other than node_redis
will work if they support the same interface. Just pass the client instance as the client
configuration option. Known supported clients include:
You can use redis-mock as the client instead of connecting to an actual redis server for automated testing and development purposes.
By default, the node_redis
client will auto-reconnect when a connection is lost. But requests may come in during that time. In Express, this scenario can be handled by including a "session check".
app.use(session( /* setup session here */ ))
app.use(function (req, res, next) {
if (!req.session) {
return next(new Error('oh no')) // handle error
}
next() // otherwise continue
})
If you want to retry, here is another option.
MIT
FAQs
Redis session store for Connect
We found that connect-redis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.