I'm submitting a ...
[X] bug report
[ ] feature request
[ ] question about the decisions made in the repository
[ ] question about how to use this project
Summary
Existing encrypted session objects from connect-mongo v3.2.0 remain over-stringified when decrypted by v4.4.1, as described in #393.
Other information
Steps to reproduce:
(Minimal docker-compose project to reproduce the issue: https://github.com/pauldwaite/connect-mongo-issue-420)
- Start an Express web app that creates a session using connect-mongo 3.2.0.
- Visit the web app in a browser.
- Stop the web app (but persist the session data)
- Update the web app to use connect-mongo 4.4.1
- Restart the web app
- Refresh the browser
Expected behaviour
The session still exists, and works correctly.
Actual behaviour
connect-mongo throws an error:
Error: Unable to parse ciphertext object!
at /workdir/node_modules/connect-mongo/build/main/lib/MongoStore.js:187:23
at processTicksAndRejections (internal/process/task_queues.js:93:5)
at async MongoStore.decryptSession (/workdir/node_modules/connect-mongo/build/main/lib/MongoStore.js:186:31)
at async /workdir/node_modules/connect-mongo/build/main/lib/MongoStore.js:211:21
TypeError: Cannot read property 'expires' of undefined
at MongoStore.Store.createSession (/workdir/node_modules/express-session/session/store.js:87:29)
at inflate (/workdir/node_modules/express-session/index.js:368:13)
at /workdir/node_modules/express-session/index.js:495:11
at /workdir/node_modules/connect-mongo/build/main/lib/MongoStore.js:218:17
at processTicksAndRejections (internal/process/task_queues.js:93:5)
Additional information
I added a breakpoint in the get method in kruptein, and the cipher text variable started like this:
"\"{\\\"hmac\\\":\\\"97d0b61cd19623a...
Which I thought looked a bit like the over-stringified session object referred to in issue #393.
I'm submitting a ...
[X] bug report
[ ] feature request
[ ] question about the decisions made in the repository
[ ] question about how to use this project
Summary
Existing encrypted session objects from connect-mongo v3.2.0 remain over-stringified when decrypted by v4.4.1, as described in #393.
Other information
Steps to reproduce:
(Minimal docker-compose project to reproduce the issue: https://github.com/pauldwaite/connect-mongo-issue-420)
Expected behaviour
The session still exists, and works correctly.
Actual behaviour
connect-mongo throws an error:
Additional information
I added a breakpoint in the
getmethod in kruptein, and thecipher textvariable started like this:Which I thought looked a bit like the over-stringified session object referred to in issue #393.