mozilla / node-client-sessions

secure sessions stored in cookies
Mozilla Public License 2.0
759 stars 104 forks source link

[WARNING] This package is abandoned and broken (no SameSite support) #150

Open mandatoryprogrammer opened 3 years ago

mandatoryprogrammer commented 3 years ago

Hoping to save people some time if they peek at the issues tab before using this. I wasted a good amount of time with this until I realized it was just broken.

This package is no longer maintained by anyone. It currently does not work for cross-site requests due to using an outdated version of the cookies library which doesn't support SameSite cookies. So if you have two origins (e.g. https://www.example.com and https://api.example.com) and you want to use this package for cookies: steer clear. If your entire site is served under a single origin this will still work for you.

There's actually a PR which fixes this huge issue here (but again, this is abandoned so it's likely not getting merged): https://github.com/mozilla/node-client-sessions/pull/142