src/lib/server/session.js - master - Alcatraz/Wagomon

src/lib/server/session.js
65 строк2 KB
saitgalineu
vkr
26 май 2026, 10:08
26 май 2026, 10:08f9b2919
import crypto from 'crypto';
import 'dotenv/config';

const SESSION_COOKIE_NAME = 'sid';
const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14;

function getSecret() {
    const secret = process.env.SESSION_SECRET;
    if (!secret) {
        throw new Error('SESSION_SECRET is not set');
    }
    return secret;
}

export function createSessionCookie(payload) {
    const secret = getSecret();
    const issuedAt = Date.now();
    const data = { ...payload, iat: issuedAt };
    const json = JSON.stringify(data);
    const hmac = crypto.createHmac('sha256', secret).update(json).digest('hex');
    const value = Buffer.from(JSON.stringify({ d: data, s: hmac })).toString('base64url');
    return {
        name: SESSION_COOKIE_NAME,
        value,
        options: {
            path: '/',
            httpOnly: true,
            sameSite: 'lax',
            secure: false, 
            maxAge: Math.floor(SESSION_TTL_MS / 1000)
        }
    };
}

export function readSessionCookie(cookieHeader) {
    if (!cookieHeader) return null;
    const value = cookieHeader.get(SESSION_COOKIE_NAME);
    if (!value) return null;
    try {
        const secret = process.env.SESSION_SECRET;
        if (!secret) return null; 
        const decoded = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
        const { d, s } = decoded;
        const expected = crypto.createHmac('sha256', secret).update(JSON.stringify(d)).digest('hex');
        if (expected !== s) return null;
        if (Date.now() - d.iat > SESSION_TTL_MS) return null;
        return d;
    } catch (_) {
        return null;
    }
}

export function clearSessionCookie() {
    return {
        name: SESSION_COOKIE_NAME,
        value: '',
        options: {
            path: '/',
            httpOnly: true,
            sameSite: 'lax',
            secure: false,
            maxAge: 0
        }
    };
}