Show HN: Express-Session-JWT

npmjs.com

3 pointsecesena3 comments

Author here. We forked express-session to use JWT as session tokens and improve security [1, 2], notably:

- Prevent session fixation (e.g., when a user logs in a new token is emitted)

- Guarantee that destroyed sessions can't be re-saved (e.g., a logged out session can't become alive again)

- Reduce the impact of data theft from the store (stores hash(sessId) instead of sessId)

We put extra care on tests (well, as anyone should). This fork passes all tests of the original express-session and we added new tests to validate the new security guarantees. Feedback is very welcome.

[1] https://supertokens.io/blog/express-session-vs-supertokens-f...

[2] https://hackernoon.com/secure-sessions-in-javascript-forking...

I am not sure why people use express where there is better and maintained fastify https://www.fastify.io/

https://github.com/fastify/fastify-jwt

I'm a fan of Fastify too, but express-session has 4M downloads/mo. Enough to be worried, I think, and to merit a fork.

Reply on news.ycombinator.com