senchalabs/connect — pull request #778 by botverse (2013-04-03 18:13:16+00:00)
Title: Allow sharing sessions across domains

If you try to share the session store across other application mounted for other domain (ie: sharing the session between domains under the same node instance)

You can't beacause this in session.js

// generates the new session
store.generate = function(req){
req.sessionID = utils.uid(24);
req.session = new Session(req);
req.session.cookie = new Cookie(cookie);
};

If you ejecute session() to get the middleware in different applications, the last will override the generate method so something like this wouldn't work in the receiving application.

express.session({ store: sharedSessionStore });
...
// later on during the request, we clear the cookie
// so we force to generate a new session
res.clearCookie("connect.sid", { domain: "domain.com" });
// with the passed session id
req.sessionID = sessionToHijackID;

If this provocates security issue, would be nice to have an alternative to deal with the shared sessions.