Add session-hijacking prevention to TODO.md

TODO.md

@@ -9,6 +9,7 @@
 - [ ] Fix React SSR error handling
 - [ ] Add React error boundaries
 - [x] Use strings as ids for big decimals TODO verify
+- [ ] Regenerate session id after logging in to prevent session hijacking
 
 - [ ] Social logins
   - [ ] GitHub

packages/server/src/routes/configureAuthRoutes.ts

@@ -27,6 +27,17 @@ export function configureAuthRoutes(
       return
     }
     await req.logInPromise(user)
+    // TODO regenerate session - prevent session hijacking
+    //
+    // Something like:
+    //     var temp = req.session.passport; // {user: 1}
+    //     req.session.regenerate(function(err){
+    //         //req.session.passport is now undefined
+    //         req.session.passport = temp;
+    //         req.session.save(function(err){
+    //             res.send(200);
+    //         });
+    //     });
     return user
   })