senchalabs/connect — Issue #451: have option to tie concept of session with a login session
Author: mudukutore
Created: 2012-01-06 16:29:27+00:00
State: open

When using the session middleware, I see that a new session cookie object is
created if:
a. the request has no session object passed in via cookie, or
b. there is no matching session-id in the session store for the
session object passed in via request cookie

It would be nice to have some support from the API such that session objects are created
(or retained) only for authenticated users. For all other requests, there should be no
session object created. I believe this can benefit applications in several ways (see below):
a. It will reduce the number of session objects that need to be retained in the session store
b. It will reduce the possibility of malicious attacks from unauthorized users trying to cause server
to run out of memory.
c. It ties in the concept of session with a login-session which is the typical session usage for several applications.