@blaasvaer/frmwrk 0.3.4 → 0.3.8

package/handle-request.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const fs = require('fs');
+const crypto = require('crypto');
 const path = require('path');
 const statics = require('serve-handler');
 const { findRoute } = require('./router');
@@ -11,6 +12,15 @@ const content_types = {
 	"json" : 'application/json; charset=utf-8'
 };
 
+/**
+ * Generate a secure session id
+ * @returns string
+ */
+function generateSecureSessionID () {
+	// Use 32 bytes (64 hex characters) for high security
+	return crypto.randomBytes(32).toString('hex'); 
+}
+
 /**
  * Handle incoming request
  * @param  {Object} req The incoming request object
@@ -127,7 +137,9 @@ async function handleRequest( req, res ) {
 				// res.setHeader( 'Content-Security-Policy', "default-src 'self'; img-src 'self';");
 		
 				// Cookies
-				res.setHeader('Set-Cookie','uuid=1234-1324-1234-1234-1234; Max-Age=3000; SameSite=lax; Secure');
+				const secureSessionId = generateSecureSessionID();
+				// res.setHeader('Set-Cookie','uuid=1234-1324-1234-1234-1234; Max-Age=3000; SameSite=lax; Secure');
+				res.setHeader('Set-Cookie',`SESSIONID=${secureSessionId}; Max-Age=3000; SameSite=lax; Secure`);
 				// Set a same-site cookie for first-party contexts
 				// res.cookie('cookie1', 'value1', { sameSite: 'lax' });
 				// Set a cross-site cookie for third-party contexts

package/index.js

@@ -9,7 +9,9 @@
 /**
  * Native modules
  */
+const fs = require('fs');
 const http = require('http');
+const https = require('https');
 const { Server } = require('socket.io');
 
 let port;
@@ -122,6 +124,8 @@ console.log("Authorize - check credentials:", credentials);
 	 */
 	Install( config )
 	.then(( result ) => {
+		let server;
+
 		/**
 		 * Run optional post install processes here …
 		 */
@@ -130,9 +134,28 @@ console.log("Authorize - check credentials:", credentials);
 		 * Create and start the server
 		 * @return {function} Server instance
 		 */
-		const server = http.createServer( handleRequest ).listen(port, hostname, () => {
-			console.log(`Server running at http://${hostname}:${port}`);
-		});
+		if ( config.protocol === 'https' ) {
+			/**
+			 * SSL Configurations options
+			 * These paths should be provided in your framework's config object
+			 */
+			const sslOptions = {
+				key: fs.readFileSync(config.sslKeyPath || './certs/key.pem'),
+				cert: fs.readFileSync(config.sslCertPath || './certs/cert.pem')
+			};
+
+			/**
+			 * Create and start the secure server
+			 * @return {function} Server instance
+			 */
+			server = https.createServer( sslOptions, handleRequest ).listen(port, hostname, () => {
+				console.log(`Server running at https://${hostname}:${port}`);
+			});
+		} else {
+			server = http.createServer( handleRequest ).listen(port, hostname, () => {
+				console.log(`Server running at http://${hostname}:${port}`);
+			});
+		}
 
 		if ( config.enable_socket_io ) {
 			_io = new Server( server );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blaasvaer/frmwrk",
-  "version": "0.3.4",
+  "version": "0.3.8",
   "description": "My personal Node framework",
   "main": "index.js",
   "scripts": {