
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
drachtio-session
Advanced tools

drachtio-session adds session storage capability for applications built using drachtio.
var app = require('drachtio')()
,session = require('drachtio-session')
,RedisStore = require('drachtio-redis')()
,config = require('../fixtures/config') ;
app.connect( config.connect_opts ) ;
app.use(session({store: new RedisStore({host: 'localhost'}), app:app})) ;
app.invite(function(req, res){
req.session.user='jack jones' ;
res.send( 200,{
body: config.sdp
}) ;
}) ;
app.bye(function(req, res){
res.send(200) ;
assert(req.session.user === 'jack jones') ;
}) ;
An application must establish a session store by using the drachtio-session middleware, as shown above. By doing so, each SIP dialog that gets created will have an associated session, into which the application can save variables. A session will get created for each incoming INVITE that establishes a SIP dialog. This session -- and any variables stored therein -- will then be available on any subsequent requests received within that dialog.
By default, each outgoing new INVITE that is sent by an application will also establish a new session; however, as we shall see in the next section, this can be overridden to enable multiple SIP dialogs to share a single unified session object.
Many sip applications act as a back-to-back user agent; receiving an incoming SIP INVITE and then generating a new outbound SIP INVITE, and managing two different SIP dialogs. Such a scenario calls for a unified session object that can be accessible from a request or an event on either of the SIP dialogs. To enable using an existing session when creating a new SIP INVITE, simply provide a session property on the opts property of the app.siprequest method.
app.use(session({store: sessionStore, app:app})) ;
app.invite( function(req, res) {
req.session.uasCallId = req.get('call-id') ;
// send an INVITE but don't create a new session
app.siprequest( config.remote_uri2, {
body: req.body
,session: req.session
}, function( err, uacReq, uacRes ) {
if( uacRes.statusCode >= 200 ) {
uacRes.ack() ;
uacReq.session.uacCallId = uacReq.get('call-id') ;
}
res.send( uacRes.statusCode, {
body: uacRes.body
}) ;
}) ;
}) ;
// regardless of which sip dialog the request is for, we get the same session object
app.bye(function(req, res){
res.send(200) ;
var otherCallId = req.get('call-id') === req.session.uacCallId ?
req.session.uasCallId : req.session.uacCallId ;
// hang up the other leg
app.siprequest.bye({headers:{'call-id': otherCallId}}) ;
}) ;
FAQs
session storage for drachtio applications
We found that drachtio-session demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.