33 lines
693 B
Plaintext
33 lines
693 B
Plaintext
|
include::../description.adoc[]
|
||
|
|
|
||
|
|
== Noncompliant Code Example
|
||
|
|
|
||
|
|
For http://www.passportjs.org/[Passport.js]:
|
||
|
|
|
||
|
|
----
|
||
|
|
app.post('/login',
|
||
|
|
passport.authenticate('local', { failureRedirect: '/login' }),
|
||
|
|
function(req, res) {
|
||
|
|
// Sensitive - no session.regenerate after login
|
||
|
|
res.redirect('/');
|
||
|
|
});
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
For http://www.passportjs.org/[Passport.js]:
|
||
|
|
|
||
|
|
----
|
||
|
|
app.post('/login',
|
||
|
|
passport.authenticate('local', { failureRedirect: '/login' }),
|
||
|
|
function(req, res) {
|
||
|
|
let prevSession = req.session;
|
||
|
|
req.session.regenerate((err) => { // Compliant
|
||
|
|
Object.assign(req.session, prevSession);
|
||
|
|
res.redirect('/');
|
||
|
|
});
|
||
|
|
});
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../see.adoc[]
|