npmpackage.info

Gathering detailed insights and metrics for koa-encrypted-session

Other packages similar to koa-encrypted-session

koa-session

6.4.0

Koa cookie session middleware with external store support

koa-passport

6.0.0

Passport middleware for Koa

koa-generic-session

2.3.1

koa generic session store by memory, redis or others

@types/koa-session

6.4.5

TypeScript definitions for koa-session

Gathering detailed insights and metrics for koa-encrypted-session

koa-encrypted-session

Encrypted cookie session middleware extension for koa-session

3.0.7

MIT

JavaScript

69,906 3.4

Installations

npm install koa-encrypted-session

Pull Requests

Open

1

Total

158

Closed

125

Merged

32

Issues

Open

0

Total

1

Closed

1

Releases

v3.0.4

Published on 18 May 2022

v3.0.3

Published on 03 Nov 2021

View all 2 releases

Developer

nicokaiser

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

>=16

Typescript Support

No

Node Version

18.12.1

NPM Version

8.19.2 Statistics

5 Stars

95 Commits

2 Watching

3 Branches

1 Contributors

Updated on 20 Jan 2024

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

69,906

Last day

62.1%

295

Compared to previous day

Last week

11.9%

1,396

Compared to previous week

Last month

17.8%

5,569

Compared to previous month

Last year

140.5%

35,474

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

base64url koa-session sodium-native

Dev Dependencies

eslint eslint-config-prettier eslint-plugin-node eslint-plugin-prettier eslint-plugin-promise koa prettier supertest

Versions

koa-encrypted-session

Encrypted session middleware for Koa. Uses cookie-based client sessions with libsodium's Secret key box encrypted cookies.

Using client sessions provides a scalable way to store state information in the client. This eliminates the need of a database on server-side and enables to run stateless server instances.

To avoid tampering (data readout and manipulation of the client-visible cookie), session data is encrypted.

However, as a cost, sessions can not be invalidated other than by the user, scenarios such as "log out all sessions of user" are not possible.

Installation

1npm install koa-encrypted-session

Usage

This library inherits from koa-session, so all of its options can be used. An additional secretKey option is introduced, which must be a high-entropy key. This key can be generated with:

./node_modules/.bin/koa-encrypted-session-gen-key

Alternatively, a secret passphrase and (optional) a salt can be used, which is at startup hashed.

Example

1import Koa from 'koa';
2import encryptedSession from 'koa-encrypted-session';
3
4const app = new Koa();
5
6app.use(encryptedSession({
7    key: 'session',
8    maxAge: 7 * 24 * 3600 * 1000,
9    secretKey: Buffer.from('EsAg64LMvGITBBz1ZGLfDNU/MYqGDpTzJ1u4BsvIfTw=', 'base64')
10    /** Additional options from koa-session can be used */
11}, app));

Acknowledgements

The encryption parts of this code are ported to Koa from fastify-secret-session.

License

MIT

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

0

Maintained

Determines if the project is "actively maintained".

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

Score

3.4

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More