diff --git a/.changeset/hot-baboons-own.md b/.changeset/hot-baboons-own.md new file mode 100644 index 000000000000..271a39606587 --- /dev/null +++ b/.changeset/hot-baboons-own.md @@ -0,0 +1,5 @@ +--- +'astro': patch +--- + +Fixes a bug where the session ID wasn't correctly regenerated diff --git a/packages/astro/src/core/session.ts b/packages/astro/src/core/session.ts index 9ac7327c59e2..33117a47a0e2 100644 --- a/packages/astro/src/core/session.ts +++ b/packages/astro/src/core/session.ts @@ -182,9 +182,8 @@ export class AstroSession { const oldSessionId = this.#sessionID; // Create new session - this.#sessionID = undefined; + this.#sessionID = crypto.randomUUID(); this.#data = data; - this.#ensureSessionID(); await this.#setCookie(); // Clean up old session asynchronously diff --git a/packages/astro/test/sessions.test.js b/packages/astro/test/sessions.test.js new file mode 100644 index 000000000000..8490e78ba3e1 --- /dev/null +++ b/packages/astro/test/sessions.test.js @@ -0,0 +1,47 @@ +import assert from 'node:assert/strict'; +import { before, describe, it } from 'node:test'; +import testAdapter from './test-adapter.js'; +import { loadFixture } from './test-utils.js'; + +describe('Astro.session', () => { + /** @type {import('./test-utils').Fixture} */ + let fixture; + + before(async () => { + fixture = await loadFixture({ + root: './fixtures/sessions/', + output: 'server', + adapter: testAdapter(), + }); + }); + + describe('Production', () => { + let app; + before(async () => { + await fixture.build(); + app = await fixture.loadTestAdapterApp(); + }); + + async function fetchResponse(path, requestInit) { + const request = new Request('http://example.com' + path, requestInit); + const response = await app.render(request); + return response; + } + + it('can regenerate session cookies upon request', async () => { + const firstResponse = await fetchResponse('/regenerate', { method: 'GET' }); + const firstHeaders = Array.from(app.setCookieHeaders(firstResponse)); + const firstSessionId = firstHeaders[0].split(';')[0].split('=')[1]; + + const secondResponse = await fetchResponse('/regenerate', { + method: 'GET', + headers: { + cookie: `astro-session=${firstSessionId}`, + }, + }); + const secondHeaders = Array.from(app.setCookieHeaders(secondResponse)); + const secondSessionId = secondHeaders[0].split(';')[0].split('=')[1]; + assert.notEqual(firstSessionId, secondSessionId); + }); + }); +});