added in express middleware to handle session (#339)

package.json

@@ -25,7 +25,7 @@
     "test:server:functional": "babel-tape-runner -r dotenv/config server/tests/**/*.func.js | node_modules/.bin/tap-spec",
     "test:client": "mocha --require tools/testClientSetup.js tools/testSetup.js \"client/**/*.spec.js\"",
     "test": "npm run test:client && npm run test:server",
-    "updateDB":"node_modules/.bin/sequelize db:migrate --env production"
+    "updateDB": "node_modules/.bin/sequelize db:migrate --env production"
   },
   "repository": {
     "type": "git",
@@ -49,6 +49,7 @@
     "connect-history-api-fallback": "^1.3.0",
     "connect-redis": "^3.3.0",
     "cookie-parser": "^1.4.3",
+    "cookie-session": "^1.3.3",
     "csv": "^1.1.0",
     "debug": "^2.6.8",
     "dompurify": "^0.9.0",

server/config/server/index.js

@@ -3,7 +3,7 @@ const path = require('path');
 const express = require('express');
 const passport = require('passport');
 const helmet = require('helmet');
-
+const cookieSession = require('cookie-session');
 const configureSequelize = require('./sequelize');
 const configureWebpackDevMiddleware = require('./webpack-dev-middleware');
 const configureRedis = require('./redis');
@@ -23,11 +23,7 @@ module.exports = () => {
   configureWebpackDevMiddleware(app);
 
   // Configure redis, receiving connections to client, subscriber and publisher
-  const {
-    client,
-    subscriber,
-    publisher,
-  } = configureRedis();
+  const { client, subscriber, publisher } = configureRedis();
 
   // Configure session handling with redis, through the client connection.
   const { sessionMiddleware } = configureSession(client);
@@ -42,6 +38,13 @@ module.exports = () => {
   app.use(passport.session()); // Use passport middleware for auth
   app.use(helmet()); // Implements various security tweaks to http response headers
 
+  app.use(
+    cookieSession({
+      maxAge: 30 * 24 * 60 * 60 * 1000,
+      keys: [process.env.COOKIE_SESSION]
+    })
+  );
+
   app.use('/public', express.static(path.join(__dirname, '../../../public'))); // Serve /public static files when unauth
   app.use('/dist', express.static(path.join(__dirname, '../../../dist'))); // Serve /dist static diles when auth