thbrown/http-only-cookie-middleware.js

## http-only-cookie-middleware.js
// Middleware to check that our second auth cookie is present and valid
app.use(async function(request, response, next) {
  if (request.isAuthenticated()) {
    let cookieToken = request.cookies.secondaryAuthToken;
    let sessionToken = request.session.secondaryAuthToken;
    if (sessionToken !== undefined) {
      if (cookieToken !== sessionToken) {
        // The token in the cookie doesn't match the token in the session. Log the user out.
        request.logout();
        // Destroy the session.
        await new Promise((resolve, reject) => {
          request.session.destroy(function(err) {
            if (err) {
              reject(err);
            }
            resolve();
          });
        });
      }
    } else {
      // No token stored in the session, create and assign one
      // This is only required for keeping existing sessions valid (backward compatibility).
      initSecondaryAuthCookie(request, response);
    }
  }
  next();
});