prevent encryptedSessionId from being stored in the sessionStore

lib/session.js

@@ -15,6 +15,7 @@ const cookieOptsKey = Symbol('cookieOpts')
 const originalHash = Symbol('originalHash')
 const hash = Symbol('hash')
 const sessionIdKey = Symbol('sessionId')
+const encryptedSessionIdKey = Symbol('encryptedSessionId')
 
 module.exports = class Session {
   constructor (request, idGenerator, cookieOpts, cookieSigner, prevSession, sessionId = idGenerator(request)) {
@@ -24,6 +25,11 @@ module.exports = class Session {
     this[cookieSignerKey] = cookieSigner
     this[requestKey] = request
     this[sessionIdKey] = sessionId
+    this[encryptedSessionIdKey] = (
+      prevSession &&
+      prevSession[sessionIdKey] === sessionId &&
+      prevSession[encryptedSessionIdKey]
+    ) || cookieSigner.sign(this.sessionId)
     this.cookie = new Cookie((prevSession && prevSession.cookie) || cookieOpts)
 
     if (prevSession) {
@@ -34,9 +40,6 @@ module.exports = class Session {
     }
 
     this.touch()
-    if (!this.encryptedSessionId) {
-      this.encryptedSessionId = cookieSigner.sign(this.sessionId)
-    }
     this[originalHash] = this[hash]()
   }
 
@@ -146,6 +149,10 @@ module.exports = class Session {
     return this[sessionIdKey]
   }
 
+  get encryptedSessionId () {
+    return this[encryptedSessionIdKey]
+  }
+
   [hash] () {
     const sess = this
     const str = stringify(sess, function (key, val) {

test/TestStore.js

@@ -0,0 +1,12 @@
+'use strict'
+
+const { MemoryStore } = require('../lib/store')
+
+class TestStore extends MemoryStore {
+  set (sessionId, session, callback) {
+    this.store.set(sessionId, JSON.parse(JSON.stringify(session)))
+    callback()
+  }
+}
+
+module.exports = TestStore

test/base.test.js

@@ -4,7 +4,7 @@ const test = require('tap').test
 const Signer = require('@fastify/cookie').Signer
 const fastifyPlugin = require('fastify-plugin')
 const { DEFAULT_OPTIONS, DEFAULT_COOKIE, DEFAULT_SESSION_ID, DEFAULT_SECRET, DEFAULT_ENCRYPTED_SESSION_ID, buildFastify } = require('./util')
-const Store = require('../lib/fastifySession').Store
+const TestStore = require('./TestStore')
 
 test('should not set session cookie on post without params', async (t) => {
   t.plan(3)
@@ -22,8 +22,8 @@ test('should not set session cookie on post without params', async (t) => {
 })
 
 test('should save the session properly', async (t) => {
-  t.plan(6)
-  const store = new Store()
+  t.plan(11)
+  const store = new TestStore()
   const fastify = await buildFastify((request, reply) => {
     request.session.test = true
 
@@ -35,11 +35,17 @@ test('should save the session properly', async (t) => {
       const session = [...storeMap.entries()][0][1]
       const keys = Object.keys(session)
 
-      // Only storing three keys: cookie, encryptedSessionId and test
-      t.equal(keys.length, 3)
+      // Only storing two keys: cookie and test
+      t.equal(keys.length, 2)
+      t.ok(keys.includes('cookie'))
+      t.ok(keys.includes('test'))
+      t.not(keys.includes('sessionId'))
+      t.not(keys.includes('encryptedSessionId'))
+
       t.ok(session.cookie)
-      t.ok(session.encryptedSessionId)
       t.equal(session.test, true)
+      t.equal(session.sessionId, undefined)
+      t.equal(session.encryptedSessionId, undefined)
     })
     reply.send()
   }, { ...DEFAULT_OPTIONS, store })
@@ -87,7 +93,7 @@ test('should support multiple secrets', async (t) => {
   const sessionIdSignedWithNewSecret = sign(sessionId, newSecret)
 
   const storeMap = new Map()
-  const store = new Store(storeMap)
+  const store = new TestStore(storeMap)
 
   storeMap.set(sessionId, {
     test: 0,
@@ -129,7 +135,7 @@ test('should support multiple secrets', async (t) => {
       cookie: `sessionId=${sessionIdSignedWithNewSecret}; Path=/; HttpOnly; Secure`
     }
   })
-  t.not(storeMap.get(sessionId).sessionId)
+  t.equal(storeMap.get(sessionId).sessionId, undefined)
   t.equal(storeMap.get(sessionId).test, 2)
   t.equal(response2.statusCode, 200)
   t.equal(response2.headers['set-cookie'].includes(sessionId), true)

test/util.js

@@ -3,6 +3,7 @@
 const Fastify = require('fastify')
 const fastifyCookie = require('@fastify/cookie')
 const fastifySession = require('../lib/fastifySession')
+const TestStore = require('./TestStore')
 
 const DEFAULT_SECRET = 'cNaoPYAwF60HZJzkcNaoPYAwF60HZJzk'
 const DEFAULT_OPTIONS = { secret: DEFAULT_SECRET }
@@ -17,7 +18,7 @@ async function buildFastify (handler, sessionOptions, plugin) {
   if (plugin) {
     await fastify.register(plugin)
   }
-  await fastify.register(fastifySession, sessionOptions)
+  await fastify.register(fastifySession, { store: new TestStore(), ...sessionOptions })
 
   fastify.get('/', handler)
   await fastify.listen({ port: 0 })