title: Express sessions getting mixed up for some users with Passport.js
body: <p>I am running an Express node.js app that allows users to login with the PassportJS local or LinkedIn strategies and, for most users, that's working fine - they log in and see their profiles.</p>
  
  <p>For a small set of users (maybe 5%), when they first click 'sign up' then their browser seems to read another user's authenticated session cookie so they are immediately taken to a different user's profile. These users all work for the same employer but are spread across different geographical sites (not sharing a computer as I'd initially hoped). </p>
  
  <p>Their IT services aren't very helpful, so I'd be grateful if anyone has experience with a similar scenario where sessions seem to be shared when they shouldn't be? Is this likely to be an issue on my part, or their IT infrastructure?</p>
  
  <p>And I've tried the answer from a <a href="https://stackoverflow.com/questions/32307933/passportjs-session-mixed-up">similar question</a>, adding <code>app.disable('view cache');</code> to my app.js, but no joy.</p>
  
  <p>My sessions are set up with Redis so my app.js looks like:</p>
  
  <pre><code>var express = require('express');
  var app = express();
  var path = require('path');
  var port = process.env.PORT || 3000;
  var favicon = require('serve-favicon');
  var logger = require('morgan');
  var cookieParser = require('cookie-parser');
  var bodyParser = require('body-parser');
  var passport = require('passport');
  var LinkedInStrategy = require('passport-linkedin').Strategy;
  var LocalStrategy = require('passport-local').Strategy;
  var config = require('./config').config();
  var bcrypt = require('bcrypt-nodejs');
  var helmet = require('helmet')
  var Model = require('./data/models/model');
  
  app.disable('view cache');
  
  app.use(session({ 
    store: new RedisStore({
    host: '127.0.0.1',
    port: 6379
  }), secret: 'mysecretkey' }));
  
  app.use(passport.initialize());
  app.use(passport.session());
  
  // view engine and routes here
  
  passport.serializeUser(function(user, done) {
    done(null, user);
  });
  
  passport.deserializeUser(function(obj, done) {
    if (obj.provider != 'linkedin'){
      new Model.User({id: obj.id}).fetch().then(function(user) {
        done(null, user.attributes);
      })
    }
    else {
      new Model.User({email: obj.emails[0].value}).fetch().then(function(data) {
        if(data != null){
          return done(null, data.attributes);
        }
        else{
          return done(null, obj);
        }
      })
    }  
  });
  
  app.listen(port);
  </code></pre>
  
  <p><em>#update2</em></p>
  
  <p>My nginx config:</p>
  
  <pre><code>  location / {
      proxy_pass http://1.2.3.4:3000;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_cache_bypass $http_upgrade;
    }
  </code></pre>