crypto: Provide OWASP session management security recommendations

README.md

@@ -48,6 +48,7 @@ app.use(session({
   get a stale entry, as if it had already been deleted.
 * `noDisposeOnSet` By default, if you set a `dispose()` method, then it'll be called whenever a `set()` operation overwrites an existing key. If you set this option, `dispose()` will only be called when a key falls out of the cache, not when it is overwritten.
 * `serializer` An object containing `stringify` and `parse` methods compatible with Javascript's `JSON` to override the serializer used.
+* `secret` Enables transparent encryption of sessions to support [OWASP session management](https://owasp.org/www-project-cheat-sheets/cheatsheets/Session_Management_Cheat_Sheet.html) recommendations
 
 ## Methods
 

lib/memorystore.js

@@ -74,6 +74,11 @@ module.exports = function (session) {
     this.options.stale = options.stale
     this.options.noDisposeOnSet = options.noDisposeOnSet
 
+    if (options.secret) {
+      this.secret = options.secret
+      this.kruptein = require('kruptein')(options)
+    }
+
     this.serializer = options.serializer || JSON
     this.store = LRU(this.options)
     debug('Init MemoryStore')
@@ -106,6 +111,16 @@ module.exports = function (session) {
     debug('GOT %s', data)
     var err = null
     var result
+
+    if (this.secret) {
+      this.kruptein.get(this.secret, data, function(err, ct) {
+        if (err)
+          return fn(err)
+
+        data = JSON.parse(ct)
+      })
+    }
+
     try {
       result = this.serializer.parse(data)
     } catch (er) {
@@ -134,6 +149,15 @@ module.exports = function (session) {
       fn && defer(fn, err)
     }
 
+    if (this.secret) {
+      this.kruptein.set(this.secret, jsess, function(err, ct) {
+        if (err)
+          return fn(err)
+
+        jsess = ct
+      })
+    }
+
     store.set(sid, jsess, ttl)
     debug('SET "%s" %s ttl:%s', sid, jsess, ttl)
     fn && defer(fn, null)
@@ -176,16 +200,44 @@ module.exports = function (session) {
     var ttl = getTTL(this.options, sess, sid)
 
     debug('EXPIRE "%s" ttl:%s', sid, ttl)
+
+    var data = store.get(sid)
+    if (!data) return fn()
+
     var err = null
-    if (store.get(sid) !== undefined) {
-      try {
-        var s = this.serializer.parse(store.get(sid))
-        s.cookie = sess.cookie
-        store.set(sid, this.serializer.stringify(s), ttl)
-      } catch (e) {
-        err = e
-      }
+
+    if (store.secret) {
+      store.kruptein.get(store.secret, data, function(err, ct) {
+        if (err)
+          return fn(err)
+        
+        data = ct
+      })
     }
+
+    try {
+      var s = this.serializer.parse(data)
+      s.cookie = sess.cookie
+      store.set(sid, this.serializer.stringify(s), ttl)
+    } catch (e) {
+      err = e
+    }
+
+    if (store.secret) {
+      store.kruptein.set(store.secret, s, function(err, ct) {
+        if (err)
+          return fn(err)
+
+        s = ct
+      })
+    }
+
+    try {
+      store.set(sid, this.serializer.stringify(s), ttl)
+    } catch (e) {
+      err = e
+    }
+
     fn && defer(fn, err)
   }
 
@@ -220,6 +272,15 @@ module.exports = function (session) {
     var result = {}
     try {
       store.forEach(function (val, key) {
+        if (self.secret) {
+          self.kruptein.get(self.secret, val, function(err, ct) {
+            if (err)
+              return fn(err)
+
+            val = JSON.parse(ct)
+          })
+        }
+
         result[key] = self.serializer.parse(val)
       })
     } catch (e) {

package.json

@@ -30,6 +30,7 @@
   "homepage": "https://github.com/roccomuso/memorystore#readme",
   "dependencies": {
     "debug": "3.1.0",
+    "kruptein": "^2.0.5",
     "lru-cache": "^4.0.3"
   },
   "devDependencies": {