Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
redis-sessions
Advanced tools
This is a Node.js module to keep sessions in a Redis datastore and add some useful methods.
The main purpose of this module is to generalize sessions across application server platforms. We use nginx reverse proxy to route parts of a website to a Node.js server and other parts could be Python, Ruby, .net, PHP, Coldfusion or Java servers. You can then use rest-sessions to access the same sessions on all app servers via a simple REST interface.
If you use Express check out https://www.npmjs.com/package/connect-redis-sessions for a ready to use middleware.
npm install redis-sessions
webapp
, app_cust123
).create
: A session is created by supplying the app and an id (usually the unique id of the user). A token will be returned.get
: A session is queried with the app and token.set
: Additional data (key/value) can be stored in the session.kill
: A session can be killed with the app and token.killall
: All sessions of an app can be killed.activity
: Get the amount of active sessions of an app within the last n seconds.soid
: Get all sessions of a single id.killsoid
: Kill all sessions that belong to a single id. E.g. log out user123 on all devices.soapp
: Get an array of all sessions of an app which were active within the last n seconds.With Redis being run on the same machine the test script (run via npm test
) on a 2011 iMac:
See rest-sessions.
RedisSessions = require("redis-sessions");
//
// Parameters for RedisSession:
//
// e.g. rs = new RedisSession({host:"192.168.0.20"});
//
// `port`: *optional* Default: 6379. The Redis port.
// `host`, *optional* Default: "127.0.0.1". The Redis host.
// `options`, *optional* Default: {}. Additional options. See: https://github.com/mranney/node_redis#rediscreateclientport-host-options
// `namespace`: *optional* Default: "rs". The namespace prefix for all Redis keys used by this module.
// `wipe`: *optional* Default: 600. The interval in second after which the timed out sessions are wiped. No value less than 10 allowed.
// `client`: *optional* An external RedisClient object which will be used for the connection.
//
rs = new RedisSessions();
rsapp = "myapp";
Parameters:
app
(String) The app id (namespace) for this session.id
(String) The user id of this user. Note: There can be multiple sessions for the same user id. If the user uses multiple client devices.ip
(String) IP address of the user. This is used to show all ips from which the user is logged in.ttl
(Number) optional The "Time-To-Live" for the session. Default: 7200.d
(Object) optional Additional data to set for this sessions. (see the "set" method)
// Set a session for `user1001`
rs.create({
app: rsapp,
id: "user1001",
ip: "192.168.22.58",
ttl: 3600,
d: {
foo: "bar",
unread_msgs: 34
}
},
function(err, resp) {
// resp should be something like
// {token: "r30kKwv3sA6ExrJ9OmLSm4Wo3nt9MQA1yG94wn6ByFbNrVWhcwAyOM7Zhfxqh8fe"}
});
Notes:
ttl
isn't reached this token can be used to get the session object for this user.user1001
in this case) might have other sessions.soid
(sessions of id) method to find other sessions of this user or the killsoid
(Kill sessions of id) method to kill his other sessions first.rs.set({
app: rsapp,
token: "r30kKwv3sA6ExrJ9OmLSm4Wo3nt9MQA1yG94wn6ByFbNrVWhcwAyOM7Zhfxqh8fe",
d: {
"unread_msgs": 12,
"last_action": "/read/news",
"birthday": "2013-08-13"
}},
function(err, resp) {
/*
resp contains the session with the new values:
{
"id":"user1001",
"r": 1,
"w": 2,
"idle": 1,
"ttl": 7200,
"d":
{
"foo": "bar",
"unread_msgs": 12,
"last_action": "/read/news",
"birthday": "2013-08-13"
}
}
*/
});
Note: The key foo
that we didn't supply in the set
command will not be touched. See Set/Update/Delete details for details on how to remove keys.
rs.get({
app: rsapp,
token: "r30kKwv3sA6ExrJ9OmLSm4Wo3nt9MQA1yG94wn6ByFbNrVWhcwAyOM7Zhfxqh8fe"},
function(err, resp) {
/*
resp contains the session:
{
"id":"user1001",
"r": 2, // The number of reads on this token
"w": 2, // The number of writes on this token
"idle": 21, // The idle time in seconds.
"ttl": 7200, // Timeout after 7200 idle time
"d":
{
"foo": "bar",
"unread_msgs": 12,
"last_action": "/read/news",
"birthday": "2013-08-13"
}
}
*/
});
Set/Update/Delete parameters by supplying app, token and some data d
.
The d
object contains a simple key/value list where values
can be string, number, boolean or null.
To remove keys set them to null
, keys that are not supplied will not be touched.
rs.set({
app: rsapp,
token: "r30kKwv3sA6ExrJ9OmLSm4Wo3nt9MQA1yG94wn6ByFbNrVWhcwAyOM7Zhfxqh8fe",
d: {
"unread_msgs": null
"last_action": "/read/msg/2121"
}},
function(err, resp) {
/*
resp contains the session with modified values:
{
"id":"user1001",
"r": 2,
"w": 3,
"idle": 1,
"ttl": 7200,
"d":
{
"last_action": "/read/msg/2121",
"birthday": "2013-08-13",
"foo": "bar"
}
}
*/
});
Kill a single session by supplying app and token:
rs.kill({
app: rsapp,
token: "r30kKwv3sA6ExrJ9OmLSm4Wo3nt9MQA1yG94wn6ByFbNrVWhcwAyOM7Zhfxqh8fe"},
function(err, resp) {
/*
resp contains the result:
{kill: 1}
*/
});
Note: If {kill: 0}
is returned the session was not found.
Query the amount of active session within the last 10 minutes (600 seconds). Note: Multiple sessions from the same user id will be counted as one.
rs.activity({
app: rsapp,
dt: 600},
function(err, resp) {
/*
resp contains the activity:
{activity: 12}
*/
});
Get all sessions of an app there were active within the last 10 minutes (600 seconds).
rs.soapp({
app: rsapp,
dt: 600},
function(err, resp) {
/*
resp contains the sessions:
{ sessions:
[ { id: 'someuser123',
r: 1,
w: 1,
ttl: 30,
idle: 0,
ip: '127.0.0.2'
},
{ id: 'anotheruser456',
r: 4,
w: 2,
ttl: 7200,
idle: 24,
ip: '127.0.0.1' }
]
}
*/
});
Get all sessions within an app that belong to a single id. This would be all sessions of a single user in case he is logged in on different browsers / devices.
rs.soid({
app: rsapp,
id: "bulkuser_999"},
function(err, resp) {
/*
resp contains the sessions:
{ sessions:
[ { id: 'bulkuser_999',
r: 1,
w: 1,
ttl: 30,
idle: 0,
ip: '127.0.0.2' },
{ id: 'bulkuser_999',
r: 1,
w: 1,
ttl: 7200,
idle: 0,
ip: '127.0.0.1' }
]
}
*/
});
Kill all sessions of an id within an app:
rs.killsoid({app: rsapp, id: 'bulkuser_999'},
function(err, resp) {
/*
resp contains the result:
{kill: 2} // The amount of sessions that were killed
*/
});
Kill all sessions of an app:
rs.killall({app: rsapp},
function(err, resp) {
/*
resp contains the result:
{kill: 12} // The amount of sessions that were killed
*/
});
See https://github.com/smrchy/redis-sessions/blob/master/CHANGELOG.md
Check out my projects which are based on Node.js and Redis as a datastore:
If you run a Redis server and currently use Amazon SQS or a similar message queue you might as well use this fast little replacement. Using a shared Redis server multiple Node.js processes can send / receive messages.
A Node.js helper library to make tagging of items in any legacy database (SQL or NoSQL) easy and fast. Redis is used to store tag-item associations and to allow fast queries and paging over large sets of tagged items.
limit
and offset
Copyright © 2013 Patrick Liess, http://www.tcs.de
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
0.5.2
FAQs
An advanced session store for Redis
The npm package redis-sessions receives a total of 859 weekly downloads. As such, redis-sessions popularity was classified as not popular.
We found that redis-sessions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.