Globally disabling cookies?

[geoffreak]

I'm creating an API and I am trying to figure out how to disable cookies in my application. We will be using headers for authentication of our API and have no need for cookies.

I was expecting that not having a session config or setting module.exports.session = null would do the trick, but that does not seem to be the case.

[sgress454]

What you want is to set req.session = null. You can do this in a blanket policy, but currently these don't cover blueprint actions. To ensure full coverage, you could define a route like so in the config/routes.js file:

"/*" : "SessionController.disable"

and in SessionController.js:

module.exports = {
    disable: function(req, res, next) {
        req.session = null;
        next();
    }
};

[geoffreak]

Thanks for the tip, that seems to work. It would be nice if this was a more configurable option though.

[sgress454]

Good call--we'll take a look at that!

[amonaco]

If your starting point is Sails and then you start to remove a lot of default options, then maybe your starting building block should be just plain Express and then add only what you need. API developer here.

[gadelkareem]

+1

[theblang]

@sgress454 Was this ever made configurable?

[JetFault]

I would also like to know the same. Right now what I do is remove the cookieParser middleware, to not allow reading, but would be nice to also remove setting.

Also, do sockets work without cookies, I'm having socket issues right now, but don't know if that's the issue as of yet.

[Clan-Utility]

+1

[leompeters]

You can disable sessions in Sails, that should disable cookies. Add the code below in your .sailsrc:

{
  ...
  "hooks": {
    "session": false
  }
}

Source: http://sailsjs.org/documentation/reference/configuration/sails-config-session#?disabling-sessions