Session keys that start with _ don't work about cookie-session

[DanWahlin]

I hit this as well. Any plans on allowing support for "_"?

[dougwilson]

yes, in 2.0.0

[DanWahlin]

Thanks - appreciate the info.

[dougwilson]

no problem. i need to schedule some tlc time with this module, it seems :)

[DanWahlin]

I'm happy either way - can't complain about modules that help jump-start my project. :-) But, it'd definitely be nice to get that in there for sure. The Lusca project uses a session key that starts with "_" so CSRF ends up being broken without being able to get back to the key. We're hoping they'll make the key configurable.

[dougwilson]

you could always use csurf for the csrf middleware part :) https://github.com/expressjs/csurf

[dougwilson]

app.use(lusca.csrf());

is pretty much the same as the following. it looks like the lusca csrf was a rip off of the of the older csurf, but csurf has continued to evolve.

app.use(csurf())
app.use(function (req, res, next) {
  req.locals._csrf = req.csrfToken() // this is to mimic default lusca.csrf behavior
})

[dougwilson]

you can have csurf store the secret in the cookies directly (i.e. built-in double-submit cookie support) without even needing to add the secret into your session cookie:

app.use(csurf({ cookie: true }))

[DanWahlin]

Good info - thanks. I'll try some of that. I'm not actually using Lusca directly....KrakenJS is. I think the csurf option could work around that though.

[dougwilson]

Gotcha. Yea, their thing has configuration options so you should be able to turn off the appsec csrf option.

[ForbesLindesay]

Lusca is also updating to remove the underscore (or at least add an option) so well so that should help.

csurf is cool but I also use all the other lusca features and prefer to do all the security in one place if possible.

[DanWahlin]

Yeah - caught that thread last night as well and am glad they'll be updating it. It definitely has some other options that I like as well.

[dougwilson]

No problem. I was just trying to throw out solutions that would help you immediately so youo didn't have to wait for one of the modules to eventually update :)

[DanWahlin]

Appreciate it Doug - thanks.