eiriklv/session.socket.io — pull request #3 by tstrimple (2014-12-11 07:36:03+00:00)
Title: fixed security issue and cookie secret bug

See the issue here: http://stackoverflow.com/questions/27276243/session-is-undefined-using-sesssion-socket-io-express4/27417124#27417124

The only way signedCookies should exist is if it's been parsed by the cookieParser. If it has been parsed by the cookie parser, then you shouldn't need to strip away the signature. Furthermore, if you're not validating the cookie signature (like when cookie-parser doensn't have a secret), you are introducing a security risk. This enables people to modify their session id and potentially impersonate users. The cookie-parser prevents this by setting the cookie value to undefined if the signature doesn't match.

The workaround I'm removing is only necessary if you're using the old connect cookieParser which should not be used in Express 4 applications anyway.