express-session - the difference between session id and connect.sid?

Question

What the difference between session id and connect.sid?

For example:

console.log('session id =', req.sessionID)

Result:

session id = CCw2pSpdPf8NRKLQpFH-nlFztEzps24Q 

And:

console.log('req.headers =', req.headers)

Result:

req.headers = {                                                                                                                                         20:51:34
  host: 'localhost:3000',
  connection: 'keep-alive',
  'cache-control': 'max-age=0',
  'upgrade-insecure-requests': '1',
  'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 ' +
    '(KHTML, like Gecko) Chrome/73.0.3683.75 ' +
    'Safari/537.36',
  dnt: '1',
  accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'accept-encoding': 'gzip, deflate, br',
  'accept-language': 'en-GB,en-US;q=0.9,en;q=0.8',
  cookie: 'connect.sid=s%3ACCw2pSpdPf8NRKLQpFH-nlFztEzps24Q.P04Tx%2FNboFGXvR34HOjpbeh4ogWy58zs%2Bpyde%2FkuUVs',
  'if-none-match': 'W/"2f-u+/xADzzu5HL7bySP/YXVKZBlPc"'
}

CCw2pSpdPf8NRKLQpFH-nlFztEzps24Q is different from connect.sid

How do I use them in a middleware to verify the user?

Eris

Answer 1

A session identifies a particular client. The general idea is that the session object and any data you put into the session object persists on the server. When a user makes a request to your server, they present the session cookie which your session infrastructure looks up and fetches the appropriate session object. Your request handlers can then use that session object and the data you put into it for whatever you want.

The data in a session object is stored locally on your server so it is secure and cannot be messed with by the client.

How do I use them in a middleware to verify the user?

For authentication, one would typically create some state in the session object that represents whether the user has been properly authenticated or not. If not, you ask them for credentials. If so, you allow the request to proceed.

Here's some pseudo code for a middleware.

app.get("/login", (req, res) => {
   // handle login page
   res.sendFile("login.html");
});

app.post("/login", (req, res) => {
   // check auth credentials from the login form
   if (credentials good) {
       req.session.authenticated = true;
       res.redirect("/someOtherPage.html");
   } else {
       req.session.authenticated = false;
       res.redirect("/login.html");
   }

});

// middleware to allow access of already authenticated
app.use((req, res, next) => {
   // check if session already authenticated
   if (req.session.authenticated) {
       next();
   } else {
       res.redirect("/login.html");
   }
});

// route that relies on previous middleware to prove authentication
app.get("/somethingElse", (req, res) => {
   // do something for this authenticated route
});

What the difference between session id and connect.sid?

A cookie has a name and a value. By default, the cookie name for express session is connect.sid. The value for the cookie is an encrypted key that express-session uses as an index into the session store.

The session id is an internally unique id for each session object. It's used in the internal implementation of the session store. You don't really need to worry about what either of these are. They are used internally for various housekeeping purposes.

So connect.sid contains the cookie value that is sent to the client and that the client presents back to the server. It's purposely obscured with encryption and made difficult to forge or guess so that clients can't guess session values. The session id is used on the server only and does need those types of protections.

Mismatch

thanks for the answer. So connect.sid contains the cookie value that is sent to the client and that the client presents back to the server. so how can we know or verify the cookie sent back to the server is the correct one that servers sent to the client? – Eris

@laukok - Please reread my answer. Express session connects the cookie with a server-side session object and handles all the cookie stuff for you (that's one of the things it does). If the cookie doesn't match any known session, it creates a new empty session object. You put data into the session object when you verify it. When a client connects, you check their session object. If it's empty, it must be a new one that hasn't yet verified anything. If it's got your data in it indicate you previously verified it, then it's good. That's all you have to do. Check the session object. – Mismatch

Answer 2

connect.sid is 's:' + session_id + '.' + hash(session_id, secret).

The express-session package uses the cookie-signature package to append a signature hash value to the session id stored in the connect.sid cookie. So, the second part of connect.sid is a hash value of the session id and the server-side secret.

Have a look at the current implementations here: setcookie function in express-session, sign function in cookie-signature.

Daedalus