I am working on an open source express app where I don't want to provide a default session secret. So I wanted to know if there would be any problems doing this:
app.use(session({
secret: require('crypto').randomBytes(64).toString('hex')
}))
The only problem I can think of is that if the app gets restarted the secret is lost so the cookies won't have a valid signature but I think I would prefer this than to have a default public secret. Are there anything other problems to this?
horses
All 5 comments
@horses are you using the MemoryStore? If so, all your sessions will be lost on restart anyway.
Does your app have any kind of config?
joewagner
on 22 Aug 2014
Does your app have any kind of config?
Yes, but if there are no other problems with randomly generating a secret it would be a tiny bit more convienent having one less config option
horses
on 22 Aug 2014
I don't think there are any other issues with using a random secret.
joewagner
on 22 Aug 2014
Correct, if you want, you can use a random secret and the sessions would only last the lifetime of the server. The other problem if you cannot horizontally scale your application, since if you load balance between two different instances, they will have different secrets. Just keep the limitations in mind is all (and you probably should provide a way for someone to configure the secret, but just default to the random one).
dougwilson
on 22 Aug 2014
Thanks guys
horses
on 22 Aug 2014
Related issues
scaryguy
路
16Comments
rukshn
路
20Comments
antishok
路
27Comments
renehauck
路
16Comments
alex55132
路
22Comments
Most helpful comment
Correct, if you want, you can use a random secret and the sessions would only last the lifetime of the server. The other problem if you cannot horizontally scale your application, since if you load balance between two different instances, they will have different secrets. Just keep the limitations in mind is all (and you probably should provide a way for someone to configure the secret, but just default to the random one).