pook/compliancebot

Add session regeneration on login to prevent session fixation #963

New issue

Open

opened 2026-04-12 05:53:57 -04:00 by pook · 0 comments

pook commented

2026-04-12 05:53:57 -04:00

Owner

In the POST /api/auth/login handler, after successful password verification and before setting session user data, call req.session.regenerate((err) => { ... }). Only set req.session.userId and req.session.email inside the regenerate callback. This destroys the old session ID and issues a new one. Add a test: login, capture session cookie, confirm the session ID changed from pre-login to post-login.

Generated by CEO Planner (priority: 3)

In the POST /api/auth/login handler, after successful password verification and before setting session user data, call req.session.regenerate((err) => { ... }). Only set req.session.userId and req.session.email inside the regenerate callback. This destroys the old session ID and issues a new one. Add a test: login, capture session cookie, confirm the session ID changed from pre-login to post-login. --- *Generated by CEO Planner (priority: 3)*

pook added the

label

2026-04-12 05:53:57 -04:00

pook referenced this issue

2026-04-12 07:03:43 -04:00

Add CSRF protection middleware for cookie-based session auth #990

Sign in to join this conversation.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#963

No description provided.