jpallen/connect-cookie-session — Issue #3: unable to call req.session.regenerate
Author: c4milo
Created: 2012-01-25 21:02:49+00:00
State: open

Hey,

I've been looking into regenerate my session id upon first login to avoid session fixation attack and just realized connect-cookie-session is not inheriting behaviors from https://github.com/senchalabs/connect/blob/master/lib/middleware/session/store.js which seems to be the normal approach when writing session stores for Connect.

For instance:

The memory store that comes by default in Connect does the following:

https://github.com/senchalabs/connect/blob/master/lib/middleware/session/memory.js#L31

I'd believe that connect-cookie-session could do the same.

Any ideas?