merge socket.io and express.js sessions

Question

I want to merge express.js and socket.io sessions together. Below is my code (socket.io part)

var io = require('socket.io').listen(app);
io.set('log level', 1);

io.sockets.on('connection', function (socket) {
    console.log('client connected');
client.send(client.id);//send client id to client itself
socket.on('connect', function(){
    console.log(socket.id + ' connected');
});
socket.on('disconnect', function(){
    console.log(socket.id + ' disconnected');
});
});

My express.js Session settings:

app.configure(function() {
  //app.use(express.logger());
  app.use(express.bodyParser());
  app.use(express.methodOverride());
  app.use(express.static(__dirname + '/static'));
  app.use(express.cookieParser());
  app.use(express.session({store: MemStore({
    reapInterval: 60000 * 10
  }), secret:'foobar', key: 'express.sid'
}));

My main problem is in my terminal when user travels from one url to another, the session id changes also: But I don't want it to be changed.

info  - socket.io started
client connected
client connected
4Z0bYHzfWCEFzbbe4WUK disconnected
e_uSvxhSLbLAC9-F4WUL disconnected
client connected
bKDy90gsrWWTRJDD4WUM disconnected
client connected
RJ5qqCL2wfmXbd7U4WUN disconnected
client connected
wjN5Sqx4rucRtWL_4WUO disconnected

Answer 1

You are outputting the socket ID, not the session ID from express.js.

You must use the authorization event, its first parameter is an object which has an entry called sessionID . That value shouldn't change between page reloads, as it is stored in a cookie (or redis database or whatever).

Here is a good article explaining how it works: http://www.danielbaulig.de/socket-ioexpress/ , but it's a little outdated. The basic principle stays the same, but a few details have changed. For example the way he creates the server doesn't work anymore, and the connect developers have removed parseCookie() . Users are not happy with that decision, however the workaround is this easy-to-remember line of code:

connect.utils.parseSignedCookies(cookie.parse(decodeURIComponent(data.headers.cookie)), secret);

As I said, the article mentioned above should give you all the basics you need, if you want to see a working implementation, take a look at this: https://github.com/vortec/lolbr/blob/master/lib/lolbr.js

Inside the authorization event handler, you can modify the data object and access it later it using socket.handshake , in your case: socket.handshake.sessionID .

Hope that helps.