How to share sessions with Socket.IO 1.x and Express 4.x?

The solution is surprisingly simple. It's just not very well documented. It is possible to use the express session middleware as a Socket.IO middleware too with a small adapter like this:

sio.use(function(socket, next) {    sessionMiddleware(socket.request, socket.request.res, next);});

Here's a full example with express 4.x, Socket.IO 1.x and Redis:

var express = require("express");var Server = require("http").Server;var session = require("express-session");var RedisStore = require("connect-redis")(session);var app = express();var server = Server(app);var sio = require("socket.io")(server);var sessionMiddleware = session({    store: new RedisStore({}), // XXX redis server config    secret: "keyboard cat",});sio.use(function(socket, next) {    sessionMiddleware(socket.request, socket.request.res || {}, next);});app.use(sessionMiddleware);app.get("/", function(req, res){    req.session // Session object in a normal request});sio.sockets.on("connection", function(socket) {  socket.request.session // Now it's available from Socket.IO sockets too! Win!});server.listen(8080);

Just a month and a half ago I dealt with the same problem and afterwards wrote an extensive blog post on this topic which goes together with a fully working demo app hosted on GitHub. The solution relies upon express-session, cookie-parser and connect-redis node modules to tie everything up. It allows you to access and modify sessions from both the REST and Sockets context which is quite useful.

The two crucial parts are middleware setup:

app.use(cookieParser(config.sessionSecret));app.use(session({    store: redisStore,    key: config.sessionCookieKey,    secret: config.sessionSecret,    resave: true,    saveUninitialized: true}));

...and SocketIO server setup:

ioServer.use(function (socket, next) {    var parseCookie = cookieParser(config.sessionSecret);    var handshake = socket.request;    parseCookie(handshake, null, function (err, data) {        sessionService.get(handshake, function (err, session) {            if (err)                next(new Error(err.message));            if (!session)                next(new Error("Not authorized"));            handshake.session = session;            next();        });    });});

They go together with a simple sessionService module I made which allows you to do some basic operations with sessions and that code looks like this:

var config = require('../config');var redisClient = null;var redisStore = null;var self = module.exports = {    initializeRedis: function (client, store) {        redisClient = client;        redisStore = store;    },    getSessionId: function (handshake) {        return handshake.signedCookies[config.sessionCookieKey];    },    get: function (handshake, callback) {        var sessionId = self.getSessionId(handshake);        self.getSessionBySessionID(sessionId, function (err, session) {            if (err) callback(err);            if (callback != undefined)                callback(null, session);        });    },    getSessionBySessionID: function (sessionId, callback) {        redisStore.load(sessionId, function (err, session) {            if (err) callback(err);            if (callback != undefined)                callback(null, session);        });    },    getUserName: function (handshake, callback) {        self.get(handshake, function (err, session) {            if (err) callback(err);            if (session)                callback(null, session.userName);            else                callback(null);        });    },    updateSession: function (session, callback) {        try {            session.reload(function () {                session.touch().save();                callback(null, session);            });        }        catch (err) {            callback(err);        }    },    setSessionProperty: function (session, propertyName, propertyValue, callback) {        session[propertyName] = propertyValue;        self.updateSession(session, callback);    }};

Since there is more code to the whole thing than this (like initializing modules, working with sockets and REST calls on both the client and the server side), I won't be pasting all the code here, you can view it on the GitHub and you can do whatever you want with it.

express-socket.io-session

is a ready-made solution for your problem. Normally the session created at socket.io end has different sid than the ones created in express.js

Before knowing that fact, when I was working through it to find the solution, I found something a bit weird. The sessions created from express.js instance were accessible at the socket.io end, but the same was not possible for the opposite. And soon I came to know that I have to work my way through managing sid to resolve that problem. But, there was already a package written to tackle such issue. It's well documented and gets the job done. Hope it helps