如何搭建蜘蛛池_蜘蛛池搭建步骤详解：快速掌握网站外链建设技巧

旋风蜘蛛池如何营销

　　# express-session 　　[![NPM Version][npm-version-image]][npm-url] 　　[![NPM Downloads][npm-downloads-image]][node-url] 　　[![Build Status][travis-image]][travis-url] 　　[![Test Coverage][coveralls-image]][coveralls-url] 　　## Installation 　　This is a [Node.js](https://nodejs.org/en/) module available through the 　　[npm registry](https://www.npmjs.com/). Installation is done using the 　　[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): 　　```sh 　　$ npm install express-session 　　``` 　　## API 　　```js 　　var session = require('express-session') 　　``` 　　### session(options) 　　Create a session middleware with the given `options`. 　　**Note** Session data is _not_ saved in the cookie itself, just the session ID. 　　Session data is stored server-side. 　　**Note** Since version 1.5.0, the [`cookie-parser` middleware](https://www.npmjs.com/package/cookie-parser) 　　no longer needs to be used for this module to work. This module now directly reads 　　and writes cookies on `req`/`res`. Using `cookie-parser` may result in issues 　　if the `secret` is not the same between this module and `cookie-parser`. 　　**Warning** The default server-side session storage, `MemoryStore`, is _purposely_ 　　not designed for a production environment. It will leak memory under most 　　conditions, does not scale past a single process, and is meant for debugging and 　　developing. 　　For a list of stores, see [compatible session stores](#compatible-session-stores). 　　#### Options 　　`express-session` accepts these properties in the options object. 　　##### cookie 　　Settings object for the session ID cookie. The default value is 　　`{ path: '/', httpOnly: true, secure: false, maxAge: null }`. 　　The following are options that can be set in this object. 　　##### cookie.domain 　　Specifies the value for the `Domain` `Set-Cookie` attribute. By default, no domain 　　is set, and most clients will consider the cookie to apply to only the current 　　domain. 　　##### cookie.expires 　　Specifies the `Date` object to be the value for the `Expires` `Set-Cookie` attribute. 　　By default, no expiration is set, and most clients will consider this a 　　"non-persistent cookie" and will delete it on a condition like exiting a web browser 　　application. 　　**Note** If both `expires` and `maxAge` are set in the options, then the last one 　　defined in the object is what is used. 　　**Note** The `expires` option should not be set directly; instead only use the `maxAge` 　　option. 　　##### cookie.httpOnly 　　Specifies the `boolean` value for the `HttpOnly` `Set-Cookie` attribute. When truthy, 　　the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` 　　attribute is set. 　　**Note** be careful when setting this to `true`, as compliant clients will not allow 　　client-side JavaScript to see the cookie in `document.cookie`. 　　##### cookie.maxAge 　　Specifies the `number` (in milliseconds) to use when calculating the `Expires` 　　`Set-Cookie` attribute. This is done by taking the current server time and adding 　　`maxAge` milliseconds to the value to calculate an `Expires` datetime. By default, 　　no maximum age is set. 　　**Note** If both `expires` and `maxAge` are set in the options, then the last one 　　defined in the object is what is used. 　　##### cookie.path 　　Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which 　　is the root path of the domain. 　　##### cookie.sameSite 　　Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute. 　　- `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement. 　　- `false` will not set the `SameSite` attribute. 　　- `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement. 　　- `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie. 　　- `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement. 　　More information about the different enforcement levels can be found in 　　[the specification][rfc-6265bis-03-4.1.2.7]. 　　**Note** This is an attribute that has not yet been fully standardized, and may change in 　　the future. This also means many clients may ignore this attribute until they understand it. 　　##### cookie.secure 　　Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy, 　　the `Secure` attribute is set, otherwise it is not. By default, the `Secure` 　　attribute is not set. 　　**Note** be careful when setting this to `true`, as compliant clients will not send 　　the cookie back to the server in the future if the browser does not have an HTTPS 　　connection. 　　Please note that `secure: true` is a **recommended** option. However, it requires 　　an https-enabled website, i.e., HTTPS is necessary for secure cookies. If `secure` 　　is set, and you access your site over HTTP, the cookie will not be set. If you 　　have your node.js behind a proxy and are using `secure: true`, you need to set 　　"trust proxy" in express: 　　```js 　　var app = express() 　　app.set('trust proxy', 1) // trust first proxy 　　app.use(session({ 　　secret: 'keyboard cat', 　　resave: false, 　　saveUninitialized: true, 　　cookie: { secure: true } 　　})) 　　``` 　　For using secure cookies in production, but allowing for testing in development, 　　the following is an example of enabling this setup based on `NODE_ENV` in express: 　　```js 　　var app = express() 　　var sess = { 　　secret: 'keyboard cat', 　　cookie: {} 　　} 　　if (app.get('env') === 'production') 　　app.use(session(sess)) 　　``` 　　The `cookie.secure` option can also be set to the special value `'auto'` to have 　　this setting automatically match the determined security of the connection. Be 　　careful when using this setting if the site is available both as HTTP and HTTPS, 　　as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This 　　is useful when the Express `"trust proxy"` setting is properly setup to simplify 　　development vs production configuration. 　　##### genid 　　Function to call to generate a new session ID. Provide a function that returns 　　a string that will be used as a session ID. The function is given `req` as the 　　first argument if you want to use some value attached to `req` when generating 　　the ID. 　　The default value is a function which uses the `uid-safe` library to generate IDs. 　　**NOTE** be careful to generate unique IDs so your sessions do not conflict. 　　```js 　　app.use(session({ 　　genid: function(req) { 　　return genuuid() // use UUIDs for session IDs 　　}, 　　secret: 'keyboard cat' 　　})) 　　``` 　　##### name 　　The name of the session ID cookie to set in the response (and read from in the 　　request). 　　The default value is `'connect.sid'`. 　　**Note** if you have multiple apps running on the same hostname (this is just 　　the name, i.e. `localhost` or `127.0.0.1`; different schemes and ports do not 　　name a different hostname), then you need to separate the session cookies from 　　each other. The simplest method is to simply set different `name`s per app. 　　##### proxy 　　Trust the reverse proxy when setting secure cookies (via the "X-Forwarded-Proto" 　　header). 　　The default value is `undefined`. 　　- `true` The "X-Forwarded-Proto" header will be used. 　　- `false` All headers are ignored and the connection is considered secure only 　　if there is a direct TLS/SSL connection. 　　- `undefined` Uses the "trust proxy" setting from express 　　##### resave 　　Forces the session to be saved back to the session store, even if the session 　　was never modified during the request. Depending on your store this may be 　　necessary, but it can also create race conditions where a client makes two 　　parallel requests to your server and changes made to the session in one 　　request may get overwritten when the other request ends, even if it made no 　　changes (this behavior also depends on what store you're using). 　　The default value is `true`, but using the default has been deprecated, 　　as the default will change in the future. Please research into this setting 　　and choose what is appropriate to your use-case. T

应用