node.js - Using cookieParser() and cookieSession() together? -

cookieparser() gives option of signing cookies secret sentence, great prevent tampering. understand cookie signed special value, prevent tampering.

i discovered cookiesession(), find great alternative server-stored cookies (i store { loggedin = true, userid=763487246824632}, never grows).

but... found setting "secret" cookieparser() breaks things, , cookiesession() stops working if secret sentence matches. reason seems if cookie signed using same secret, cookieparser() takes , parses it. strange thing once cookieparser() has done work, , with same signature secret, session set to:

{ cookie:     { path: '/',      _expires: null,      originalmaxage: null,      httponly: true } } 

rather than:

{ testing: 'ooo' } 

(each reload adds 'o') so...

• did analysis right?
• do know why session set strange { cookie object if secret sentences match?

merc.

your analysis correct, can reproduce it.

the issue caused this line in cookiesession middleware (some context: options.secret key passed cookiesession, req.secret key passed cookieparser): if pass both middleware secret key, cookiesession assumes find raw (unparsed) cookie in req.cookies.

but since cookieparser has picked signed cookie (and it's being run before cookiesession), has parsed cookie (and because signing keys same, succeeded so), stored in req.signedcookies and deleted req.cookies. far cookiesession concerned, cookie isn't set.

the object see default session contents (which cookie property cookiesession configuration):

app.use(express.cookiesession({   cookie : { // <-- object     ...   } }); 

as solution: either use different key each middleware, or pass 1 of them secret key, not both (with understanding if pass cookieparser, all cookies signed).

fwiw: i'm not entirely sure if real bug. it's consequence of using same signing mechanism both cookieparser , cookiesession, no distinction between cookies signed 1 or other. although fixed checking if cookie located in req.signedcookies.