github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #17537 from overleaf/bg-session-mitigation-log-session-size

Browse source 
Add custom session store to track largest session sizes for anonymous users

GitOrigin-RevId: 23312689d7adb8196e66bb925afcfef78c4c558d
This commit is contained in:
Brian Gough 2024-03-12 17:15:37 +00:00 committed by Copybot
parent dfa29dad61
commit 8484ae75c7
1 changed files with 35 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
services/web/app/src/infrastructure/Server.js
View file

@ -48,8 +48,42 @@ const STATIC_CACHE_AGE = Settings.cacheStaticAssets
? oneDayInMilliseconds * 365
: 0
// Define a custom session store to record the largest session sizes
// seen for anonymous users
class CustomSessionStore extends RedisStore {
static largestSessionSize = 2048 // ignore sessions smaller than 2KB
static trackAnonymousSessionSize(sess) {
const isLoggedIn = SessionManager.isUserLoggedIn(sess)
if (!isLoggedIn) {
const len = JSON.stringify(sess, (key, value) => {
if (key === 'hashedPassword' && value?.length > 0) {
return '*'.repeat(value.length)
}
return value
}).length
if (len > CustomSessionStore.largestSessionSize) {
CustomSessionStore.largestSessionSize = len
logger.warn({ sess, sessionSize: len }, 'largest session size seen')
}
}
}
set(sid, sess, cb) {
CustomSessionStore.trackAnonymousSessionSize(sess)
super.set(sid, sess, cb)
}
touch(sid, sess, cb) {
CustomSessionStore.trackAnonymousSessionSize(sess)
super.touch(sid, sess, cb)
}
}
// Init the session store
const sessionStore = new RedisStore({ client: sessionsRedisClient })
const sessionStore = new CustomSessionStore(
new RedisStore({ client: sessionsRedisClient })
)
const app = express()