title: How to access/save the session data on the authorization event in Socket.io/express-sessions?
body: <p>I setup a websocket using Socket.io and express 4 framework on node.js server.</p>
  
  <p>I am trying to implement authorization step for my users when using my websocket.</p>
  
  <p>When a user connects, a token is passed as a query value to the server. At the server level, I query a database for a session that match the passed token. If a session is found, I do few other check to ensure that the token is not hijacked.</p>
  
  <p><strong>Problem</strong></p>
  
  <p>The session data seems to be cleared on every page reload. Or the server is failing to link the sessionId to the user who created it so everytime it generates a new session.</p>
  
  <p>I am puzzled on how to access the session variables "if they are set."</p>
  
  <p><strong>My Code's Problem</strong></p>
  
  <p>When a user reload his/her page/client, the session data will become undefined on the new request. The session is good until the page is refreshed which is my problem. I need to be able to keep the session active even after the user refresh their page.</p>
  
  <p><strong>Questions</strong></p>
  
  <p>How can ensure that the session data are not cleared on every page refresh?</p>
  
  <p>Here is my authorization code</p>
  
  <pre><code>io.set('authorization', function (handshakeData, accept) {
  
      var session = handshakeData.session || {};
  
      //This is always undefined!
      console.log('Session Data:' + session.icwsSessionId);
  
      //var cookies = handshakeData.headers.cookie;
      var token = handshakeData._query.tokenId || '';
      //console.log('Token: ' + token);
  
      if(!token){
          console.log('Log: token was not found');
          return accept('Token was found.', false);
      }
  
      //allow any user that is authorized
      if(session &amp;&amp; session.autherized &amp;&amp; token == session.token){
          console.log('Log: you are good to go');
          return accept('You are good to go', true);
      }
  
      //if the client changed their token "client logged out"
      //terminate the open session before opening a new one
      if (session.autherized &amp;&amp; token != session.token){
  
          var icwsConnection = new icwsConn(icwsRequest);
          icwsRequest.setConnection(session.icwsServer, session.icwsPort);
          icwsRequest.setIcwsHeaders(session.icwsSessionId, session.icwsToken);
          icwsConnection.logout();
  
          session.autherized = false;
          session.token = null;
          session.icwsServer = null;
          session.icwsPort = null;
          session.icwsSessionId = null;
          session.icwsToken = null;
  
          icwsConnection = null;
      }
  </code></pre>
  
  <p>Here is my entire code if needed</p>
  
  <pre><code>var env = require('./modules/config'),
      app = require('express')(),
      https = require('https'),
      fs = require('fs'),
      session = require('express-session'),
      redisStore = require("connect-redis")(session),
      sharedsession = require("express-socket.io-session"),
      base64url = require('base64url');
  
  const server = https.createServer(
      {
          key: fs.readFileSync('certs/key.pem'),
          cert: fs.readFileSync('certs/cert.pem')
      }, function (req, res){
          res.setHeader('Access-Control-Allow-Origin', '*');
          res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type');
      }
  ).listen(env.socket.port, env.socket.host, function () {
      console.log('\033[2J');
      console.log('Websocket is running at https://%s:%s', server.address().address, server.address().port);
  });
  
  var io = require('socket.io')(server);
  
  const sessionMiddleware = session({
      store: new redisStore({
          host: env.redis.host,
          port: env.redis.port
      }),
      secret: env.session.secret,
      name: env.session.name,
      rolling: false,
      resave: true,
      saveUninitialized: true
  });
  
  app.use(sessionMiddleware);
  
  
  // Use shared session middleware for socket.io
  // setting autoSave:true
  io.use(sharedsession(sessionMiddleware, {
      autoSave: true
  })); 
  
  
  var icwsReq = require('./modules/icws/request.js'),
      icwsConn = require('./modules/icws/connection.js'),
      icwsInter = require('./modules/icws/interactions.js'),
      sessionValidator = require('./modules/validator.js');
  
  var clients = {};
  var icwsRequest = new icwsReq();
  var sessionChecker = new sessionValidator();
  
  
  
  app.get('/', function (req, res) {
      res.send('welcome');
  });
  
  io.set('authorization', function (handshakeData, accept) {
  
      var session = handshakeData.session || {};
  
      //This is always undefined!
      console.log('Session Data:' + session.icwsSessionId);
  
      //var cookies = handshakeData.headers.cookie;
      var token = handshakeData._query.tokenId || '';
      //console.log('Token: ' + token);
  
      if(!token){
          console.log('Log: token was not found');
          return accept('Token was found.', false);
      }
  
      //allow any user that is authorized
      if(session &amp;&amp; session.autherized &amp;&amp; token == session.token){
          console.log('Log: you are good to go');
          return accept('You are good to go', true);
      }
  
      /*
      if (!originIsAllowed(origin)) {
          // Make sure we only accept requests from an allowed origin
          socket.destroy();
          console.log((new Date()) + ' Connection from origin ' + origin + ' rejected.');
          return false;
      }
      */
  
      //if the client changed their token "client logged out"
      //terminate the open session before opening a new one
      if (session.autherized &amp;&amp; token != session.token){
  
          var icwsConnection = new icwsConn(icwsRequest);
          icwsRequest.setConnection(session.icwsServer, session.icwsPort);
          icwsRequest.setIcwsHeaders(session.icwsSessionId, session.icwsToken);
          icwsConnection.logout();
  
          session.autherized = false;
          session.token = null;
          session.icwsServer = null;
          session.icwsPort = null;
          session.icwsSessionId = null;
          session.icwsToken = null;
  
          icwsConnection = null;
      }
  
      var myIP = '10.0.4.195';
  
      var decodedToken = base64url.decode(token);
  
      sessionChecker.validateData(decodedToken, myIP, env.session.duration, function(isValid, icws){
  
          if(isValid){
  
              session.authorized = true;
              session.icwsServer = icws.host;
              session.icwsPort = icws.port;
              session.token = token;
              session.icwsSessionId = null;
              session.icwsToken = null;
  
              icwsRequest.setConnection(icws.host, icws.port);
              var icwsConnection = new icwsConn(icwsRequest);
  
              icwsConnection.login(icws.username, icws.password, function(isLogged, icwsSession, headers){
  
                  if(isLogged &amp;&amp; icwsSession.sessionId &amp;&amp; icwsSession.csrfToken){
  
                      //icwsConnection.setWorkstation(icws.workstaton);
                      session.icwsSessionId = icwsSession.sessionId;
                      session.icwsToken = icwsSession.csrfToken;
  
                      icwsRequest.setIcwsHeaders(session.icwsSessionId, session.icwsToken);
                      console.log('Log: new connection to ICWS! ' + session.icwsSessionId );
                  }
  
              });
  
              console.log('Log: new connection to websocket!')
              return accept('New connection to websocket!', true);
  
          } else {
  
              console.log('Log: token could not be validated!');
              return accept('Token could not be validated!', false);
          }
  
      });
  
  });
  
  
  io.on('connection', function (socket) { 
  
  
      console.log('Authorized Session! Websocket id ready for action!');
      //var origin = socket.request.headers.origin || '';
      //var myIP = socket.request.socket.remoteAddress || '';
  
      if(!socket.request.sessionID){
          console.log('Missing Session ID');
          return false;
      }
  
      var socketId = socket.id;
      var sessionID = socket.request.sessionID;
  
  
      //Add this socket to the user's connection
      if(userCons.indexOf(socketId) == -1){
          userCons.push(socketId);
      }
  
      clients[sessionID] = userCons;
  
      console.log(clients); //display all connected clients
  
      socket.on('placeCall', function(msg){
  
          icwsInter.call(method, uri, params, header, true);
  
      });
  
      socket.on('chat', function(msg){
          console.log('Chat Message: ' + msg);
          socket.emit('chat', { message: msg });
      });
  
  
      socket.on('disconnect', function(msg){
          console.log('Closing sessionID: ' + sessionID);
          var userCons = clients[sessionID] || [];
  
          var index = userCons.indexOf(socketId);
  
          if(index &gt; -1){
              userCons.splice(index, 1);
              console.log('Removed Disconnect Message: ' + msg);
          } else {
              console.log('Disconnect Message: ' + msg);
          }
  
      }); 
  
      socket.on('error', function(msg){
          console.log('Error Message: ' + msg);
      }); 
  
  });
  
  
  function originIsAllowed(origin) {
      // put logic here to detect whether the specified origin is allowed.
          var allowed = env.session.allowedOrigins || []
  
          if(allowed.indexOf(origin) &gt;= 0){
              return true;
          }
  
      return false;
  }
  </code></pre>
  
  <p><strong>Edited</strong></p>
  
  <p>The <code>io</code> cookie changes on every request. When a <code>io</code> cookie is created it will have a last accessed values of <code>12/31/1969 4:00:00 PM</code></p>
  
  <p>Also, this cookie changes on every page reload.</p>
  
  <p>After @Osk suggestion below Here is my new code which is still isn't saving my session data on page reload.</p>
  
  <pre><code>var env = require('./modules/config'),
      app = require('express')(),
      https = require('https'),
      fs = require('fs'),
      session = require('express-session'),
      redisStore = require("connect-redis")(session),
      sharedsession = require("express-socket.io-session"),
      base64url = require('base64url'),
      cookieParser = require("cookie-parser");
  
  const server = https.createServer(
      {
          key: fs.readFileSync('certs/key.pem'),
          cert: fs.readFileSync('certs/cert.pem')
      }, function (req, res){
          res.setHeader('Access-Control-Allow-Origin', '*');
          res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type');
      }
  ).listen(env.socket.port, env.socket.host, function () {
      console.log('\033[2J');
      console.log('Websocket is running at https://%s:%s', server.address().address, server.address().port);
  });
  
  var io = require('socket.io')(server);
  var sessionStore = new redisStore({
          host: env.redis.host,
          port: env.redis.port
      });
  
  const sessionMiddleware = session({
          store: sessionStore,
          secret: env.session.secret,
          name: env.session.name,
          rolling: true,
          resave: false,
          saveUninitialized: false,
          cookie: { 
              maxAge: 60 * 60 * 1000
          }
      });
  
  
  app.use(sessionMiddleware);
  
  // Use shared session middleware for socket.io
  // setting autoSave:true
  io.use(sharedsession(sessionMiddleware, {
      autoSave: false
  })); 
  
  var icwsReq = require('./modules/icws/request.js'),
      icwsConn = require('./modules/icws/connection.js'),
      icwsInter = require('./modules/icws/interactions.js'),
      sessionValidator = require('./modules/validator.js');
  
  var clients = {};
  
  var icwsRequest = new icwsReq();
  var sessionChecker = new sessionValidator();
  
  
  
  app.get('/', function (req, res) {
      res.send('welcome');
  });
  
  
  //Middleware for authorizing a user before establishing a connection
  io.use(function(socket, next) {
  
  
      var origin = socket.request.headers.origin || '';
  
      if (!originIsAllowed(origin)) {
          // Make sure we only accept requests from an allowed origin
          socket.destroy();
          console.log((new Date()) + ' Connection from origin ' + origin + ' rejected.');
          return false;
      }
  
      var myIP = socket.request.socket.remoteAddress || '';
      var token = socket.handshake.query.tokenId || '';
      var session = socket.handshake.session || {};
  
      //This should be defined on a reload
      console.log('IP Address: ' + myIP + '      SessionID: ' + socket.handshake.sessionID);
  
      if(!token){
          console.log('Log: token was not found');
          return next(new Error('Token not found'));
      }
  
      //allow any user that is authorized
      if(session &amp;&amp; session.autherized &amp;&amp; token == session.token){
          console.log('Log: you are good to go');
          return next(new Error('You are good to go'));
      }
  
      //if the client changed their token "client logged out"
      //terminate the open session before opening a new one
      if (session.autherized &amp;&amp; token != session.token){
  
          var icwsConnection = new icwsConn(icwsRequest);
          icwsRequest.setConnection(session.icwsServer, session.icwsPort);
          icwsRequest.setIcwsHeaders(session.icwsSessionId, session.icwsToken);
          icwsConnection.logout();
  
          session.autherized = false;
          session.token = null;
          session.icwsServer = null;
          session.icwsPort = null;
          session.icwsSessionId = null;
          session.icwsToken = null;
          icwsConnection = null;
          session.save();
      }
  
      var decodedToken = base64url.decode(token);
  
      sessionChecker.validateData(decodedToken, myIP, env.session.duration, function(isValid, icws){
  
          if(isValid){
  
              session.authorized = true;
              session.icwsServer = icws.host;
              session.icwsPort = icws.port;
              session.token = token;
              session.icwsSessionId = null;
              session.icwsToken = null;
  
              icwsRequest.setConnection(icws.host, icws.port);
              var icwsConnection = new icwsConn(icwsRequest);
              /*
              icwsConnection.login(icws.username, icws.password, function(isLogged, icwsSession, headers){
  
                  if(isLogged &amp;&amp; icwsSession.sessionId &amp;&amp; icwsSession.csrfToken){
  
                      //icwsConnection.setWorkstation(icws.workstaton);
                      session.icwsSessionId = icwsSession.sessionId;
                      session.icwsToken = icwsSession.csrfToken;
  
                      icwsRequest.setIcwsHeaders(session.icwsSessionId, session.icwsToken);
                      console.log('Log: new connection to ICWS! ' + session.icwsSessionId );
                  }
  
              });
              */
              session.save(function(){
                  console.log('Log: new connection to websocket!');   
              });
  
              return next();
  
          } else {
  
              console.log('Log: token could not be validated!');
              return next(new Error('Token could not be validated!'));
          }
  
      });
  
  });
  
  
  io.on('connection', function (socket) { 
  
      console.log('Connection is validated and ready for action!');
  
      var socketId = socket.id;
  
      if(!socket.handshake.sessionID){
          console.log('sessionId was not found');
          return false;
      }
  
      var sessionID = socket.handshake.sessionID;
      var userCons = clients[sessionID] || [];
  
      //Add this socket to the user's connection
      if(userCons.indexOf(socketId) == -1){
          userCons.push(socketId);
      }
  
      clients[sessionID] = userCons;
  
      //console.log(clients);
  
      socket.on('placeCall', function(msg){
  
          icws.call(method, uri, params, header, true);
  
      });
  
      socket.on('chat', function(msg){
          console.log('Chat Message: ' + msg);
          socket.emit('chat', { message: msg });
      });
  
  
      socket.on('disconnect', function(msg){
          console.log('Closing sessionID: ' + sessionID);
          var userCons = clients[sessionID] || [];
  
          var index = userCons.indexOf(socketId);
  
          if(index &gt; -1){
              userCons.splice(index, 1);
              console.log('Removed Disconnect Message: ' + msg);
          } else {
              console.log('Disconnect Message: ' + msg);
          }
  
      }); 
  
      socket.on('error', function(msg){
          console.log('Error Message: ' + msg);
      }); 
  
  });
  
  
  function originIsAllowed(origin) {
      // put logic here to detect whether the specified origin is allowed.
          var allowed = env.session.allowedOrigins || []
  
          if(allowed.indexOf(origin) &gt;= 0){
              return true;
          }
  
      return false;
  }
  </code></pre>