Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
session-file-store
Advanced tools
Session file store is a provision for storing session data in the session file
Session file store for Express and Connect. Also you can use it with Koa
Session file store is a provision for storing session data in the session file
>= 4.x
and Connect >= 1.4.0
through express-session>= 8
>= 0.9.0
through express-session$ npm install session-file-store
$ npm install
$ npm test
path
The directory where the session files will be stored. Defaults to ./sessions
ttl
Session time to live in seconds. Defaults to 3600
retries
The number of retries to get session data from a session file. Defaults to 5
factor
The exponential factor to use for retry. Defaults to 1
minTimeout
The number of milliseconds before starting the first retry. Defaults to 50
maxTimeout
The maximum number of milliseconds between two retries. Defaults to 100
reapIntervalObject
[OUT] Contains intervalObject if reap was scheduledreapInterval
Interval to clear expired sessions in seconds or -1 if do not need. Defaults to 1 hour
reapAsync
use distinct worker process for removing stale sessions. Defaults to false
reapSyncFallback
reap stale sessions synchronously if can not do it asynchronously. Default to false
logFn
log messages. Defaults to console.log
fallbackSessionFn
returns fallback session object after all failed retries. No defaultsencoding
Object-to-text text encoding. Can be null. Defaults to 'utf8'
encoder
Encoding function. Takes object, returns encoded data. Defaults to JSON.stringify
decoder
Decoding function. Takes encoded data, returns object. Defaults to JSON.parse
fileExtension
File extension of saved files. Defaults to '.json'
secret
Enables transparent encryption support conforming to OWASP's Session Management best practices.crypto.algorithm
Defaults to aes-256-gcm
but supports symmetric algorithms listed from crypto.getCiphers()
.crypto.hashing
Defaults to sha512
but supports hashing algorithms listed from crypto.getHashes()
.crypto.use_scrypt
Defaults to true
. When not supported (node < 10.5) will fall back to the crypto.pbkdf2()
key derivation function.Due to express >= 4
changes, we need to pass express-session
to the function session-file-store
exports in order to extend session.Store
:
var session = require('express-session');
var FileStore = require('session-file-store')(session);
var fileStoreOptions = {};
app.use(session({
store: new FileStore(fileStoreOptions),
secret: 'keyboard cat'
}));
You can find basic work app examples
for express,
connect and
koa frameworks in examples
folder.
FAQs
Session file store is a provision for storing session data in the session file
We found that session-file-store demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.