How many people are satisfied with Express-session from a security point of view? I have seen secure solutions for other frameworks but not for node, what do you guys think?

Here are some of the problems I observed with Express.js-Express uses one longed lived access token. What happens when this gets stolen? I’v seen discussions on SO where people talk about refresh tokens, and changing them for additional security and even for detecting theft (which I think is useful)-If my secret gets compromised, there is no rotation of secret that allows me to stop using the older ones without logging existing users out.It’s surprising how such a popular framework has something so fundamental missing - or am I missing something?

Submitted November 15, 2019 at 08:25AM by ilovefunctions