Method loadSession

lib/api.js:576–648

(args, callback)

	}
	
	loadSession(args, callback) {
		// Load user session or validate API Key
		var self = this;
		var now = Tools.timeNow(true);
		var session_id = args.cookies['session_id'] || args.request.headers['x-session-id'] || args.params.session_id;
		
		if (session_id) {
			this.storage.get('sessions/' + session_id, function(err, session) {
				if (err) return callback(err, null, null);
				
				// csrf check
				var csrf_token = args.request.headers['x-csrf-token'] || args.params.csrf_token || null;
				if (self.usermgr.config.get('use_csrf') && !args.request.method.match(/^(GET|HEAD)$/) && session.csrf_token && (csrf_token != session.csrf_token)) {
					self.logError('user', "Failed to validate session: Invalid CSRF Token", { username: session.username, ips: args.ips });
					return callback(new Error("Invalid session"), null, null);
				}
				
				// also load user
				self.storage.get('users/' + self.usermgr.normalizeUsername(session.username), function(err, user) {
					if (err) return callback(err, null, null);
					
					// set type to discern this from API Key sessions
					session.type = 'user';
					
					// scrub session_id from common places, so it doesn't interfere with API calls and isn't logged
					delete args.params.session_id;
					delete args.cookies['session_id'];
					delete args.request.headers['x-session-id'];
					delete args.request.headers['cookie'];
					
					// cleanup csrf token mess as well
					delete args.params.csrf_token;
					delete args.request.headers['x-csrf-token'];
					
					// pass both session and user to callback
					callback(null, session, user);
				} );
			} );
			return;
		}
		
		// no session found, look for API Key
		var plain_key = args.request.headers['x-api-key'] || args.params.api_key || args.query.api_key;
		if (!plain_key) return callback( new Error("No Session ID or API Key could be found"), null, null );
		
		this.api.logDebug(9, "Client provided API key: " + plain_key.substring(0, 4) + '****');
		
		// find active key with matching salted hash
		var api_key = this.api_keys.find( function(api_key) {
			if (!api_key.active) return false;
			if (api_key.expires && (now >= api_key.expires)) return false;
			return ( Tools.digestHex(plain_key + api_key.id, 'sha256') === api_key.key );
		} );
		
		if (!api_key) return callback(new Error("Invalid API Key"), null, null);
		
		this.api.logDebug(9, "Matched server API Key: " + api_key.title + " (" + api_key.id + ")" );