node.js - Node.js Connect session() 参数中的安全选项是什么

Question

我正在研究以下Connect示例:

var connect = require ('connect');
var timeout = 30000; // session timeout: 30 seconds
var sessionOpts = {
    secret: 'keyboard cat',
    key: 'myapp_sid',
    cookie: { maxAge: timeout, secure: true} /*Example doesn't work with secure?*/
};

var app = connect ()
    .use (connect.favicon())
    .use (connect.cookieParser ('keyboard cat'))
    .use (connect.session(sessionOpts))
    .use (function (req, res, next) {
        var sess = req.session;
        if (sess.views) {
            res.setHeader ('Content-Type', 'text/html');
            res.write ('<p>views: ' + sess.views + '</p>');
            res.end();
            sess.views++;
        } else {
            sess.views = 1;
            res.end ('welcome to the session demo. refresh!');
        }
    })
    .listen (3000);

当我访问该网站时，如果 cookie 选项不包含 secure: true，则浏览次数会增加并在 30 秒后重置。当我包含安全选项时， session 不再停留 30 秒，每次刷新都会重置。

什么是安全选项以及如何将其与 Connect 的 session 中间件一起使用？

Answer 1

secure 参数设置secure flag对于 HTTP cookie:

The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text. To accomplish this goal, browsers which support the secure flag will only send cookies with the secure flag when the request is going to a HTTPS page. Said in another way, the browser will not send a cookie with the secure flag set over an unencrypted HTTP request.

就您的情况而言，安全 Cookie 可能根本不会发送，因为您没有通过 HTTPS 提供页面服务。