Debating these two methods of storing session data:
- https://github.com/mozilla/node-client-sessions (Store all session data in the cookie and encrypt it)
- https://github.com/expressjs/session (Session ID in cookies and use database to store session data)
Not sure which is more secure because after reading a little about the internals of node-client-sessions, there are a lot of potential attack vectors that need to be accounted for, and I'm not sure how much they account for. For example, they account for a timing attack by using a constantTime algorithm in one place. But there are many more potential vulnerabilities, and not being an expert I can't tell how well done it is as a library.
On the other hand, I have seen people say storing session id in the database is a no go. But at least here you could black list the session id.
Any advice or guidance would be greatly appreciated. Thank you.