Commit https://github.com/balderdashy/sails/commit/4a023dc5095a4b30fdc8535f705ed34cd22d2f7d breaks websocket sessions

[Lovinity]

Node version: 16.6.0
Sails version (sails): 1.5.7
ORM hook version (sails-hook-orm): latest
Sockets hook version (sails-hook-sockets): latest
Organics hook version (sails-hook-organics): Unknown
Grunt hook version (sails-hook-grunt): latest
Uploads hook version (sails-hook-uploads): Unknown
DB adapter & version (e.g. sails-mysql@5.55.5): sails-mysql latest
Skipper adapter & version (e.g. skipper-s3@5.55.5): none

Session store: memorystore (also tested flat-file-store)

---

Commit 4a023dc breaks websocket sessions. Namely, req.session is undefined even when a cookie exists in the handshake. Reverting this commit / changes to the req file fixes the problem.

Before knowing the cause of the issue, I attempted a bandage fix by creating a hook to restore req.session if it was undefined. But this did not work; sailsJS was thinking every single API call was a new client, and thus sessions were not persisting / every request had a new session.

Next, I checked cookie parsing. It was correctly receiving the cookie string, but console was outputting an empty object for the cookies. I thought this was weird and thought this was the problem as well. But I looked at the code and saw no reason for it to not work. So I moved on.

I investigated the latest changes, and that's when I noticed the change in virtual req parsing. Since sessions were stored in the req, I decided to see what would happen if I reverted that file to 1.5.6's version. Sure enough, sessions started working again.

[sailsbot]

@Lovinity Thanks for posting! We'll take a look as soon as possible.

In the mean time, there are a few ways you can help speed things along:

• look for a workaround. (Even if it's just temporary, sharing your solution can save someone else a lot of time and effort.)
• tell us why this issue is important to you and your team. What are you trying to accomplish? (Submissions with a little bit of human context tend to be easier to understand and faster to resolve.)
• make sure you've provided clear instructions on how to reproduce the bug from a clean install.
• double-check that you've provided all of the requested version and dependency information. (Some of this info might seem irrelevant at first, like which database adapter you're using, but we ask that you include it anyway. Oftentimes an issue is caused by a confluence of unexpected factors, and it can save everybody a ton of time to know all the details up front.)
• read the code of conduct.
• if appropriate, ask your business to sponsor your issue. (Open source is our passion, and our core maintainers volunteer many of their nights and weekends working on Sails. But you only get so many nights and weekends in life, and stuff gets done a lot faster when you can work on it during normal daylight hours.)
• let us know if you are using a 3rd party plugin; whether that's a database adapter, a non-standard view engine, or any other dependency maintained by someone other than our core team. (Besides the name of the 3rd party package, it helps to include the exact version you're using. If you're unsure, check out this list of all the core packages we maintain.)

---

Please remember: never post in a public forum if you believe you've found a genuine security vulnerability. Instead, disclose it responsibly.

For help with questions about Sails, click here.

[shackbarth]

We've been hit by the same thing. As of sails 1.5.7, socket requests have no session object. A revert to 1.5.6 has put us back working again.

[mikermcneil]

@shackbarth @Lovinity Eric and I are looking into this now.

EDIT: Looks like we needed a continue on line 53, and this slipped through the existing test suite. Verifying that.

EDIT: Reproduced:

EDIT: Verified that the fix resolves this.

[mikermcneil]

Thanks @eashaw for the fix! And thank you @shackbarth @Lovinity for the thoughtful report.

[mikermcneil]

fyi @DominusKelvin

Patch forthcoming

[mikermcneil]

Published as v1.5.8