From 7ecca202a518194a7a5607cf824e193a56ed84df Mon Sep 17 00:00:00 2001
From: Simon Mattsson <simonarnemattsson@gmail.com>
Date: Mon, 22 Aug 2022 16:40:32 +0200
Subject: [PATCH 1/2] basic cookieless session functionality

---
 index.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/index.js b/index.js
index 40a442ba..3bc34bec 100644
--- a/index.js
+++ b/index.js
@@ -80,6 +80,7 @@ var defer = typeof setImmediate === 'function'
  * @param {String|Array} [options.secret] Secret for signing session ID
  * @param {Object} [options.store=MemoryStore] Session store
  * @param {String} [options.unset]
+ * @param {Boolean} [options.shouldReplaceCookieWithToken] If header should be set as Cookie or X-Access-Token
  * @return {Function} middleware
  * @public
  */
@@ -114,6 +115,10 @@ function session(options) {
   // get the cookie signing secret
   var secret = opts.secret
 
+  // should the header be set as token instead of cookie
+  var shouldReplaceCookieWithToken = opts.shouldReplaceCookieWithToken
+
+
   if (typeof generateId !== 'function') {
     throw new TypeError('genid option must be a function');
   }
@@ -661,7 +666,11 @@ function setcookie(res, name, val, secret, options) {
   var prev = res.getHeader('Set-Cookie') || []
   var header = Array.isArray(prev) ? prev.concat(data) : [prev, data];
 
-  res.setHeader('Set-Cookie', header)
+  if (shouldReplaceCookieWithToken) {
+    res.setHeader('X-Access-Token', header)
+  } else {
+    res.setHeader('Set-Cookie', header)
+  }
 }
 
 /**

From 2b2dad7eb2382a472859449ec543714e8cd3105e Mon Sep 17 00:00:00 2001
From: Simon Mattsson <simonarnemattsson@gmail.com>
Date: Fri, 7 Oct 2022 16:44:44 +0200
Subject: [PATCH 2/2] remove extra carriage return

---
 index.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/index.js b/index.js
index 3bc34bec..9d61c0ff 100644
--- a/index.js
+++ b/index.js
@@ -118,7 +118,6 @@ function session(options) {
   // should the header be set as token instead of cookie
   var shouldReplaceCookieWithToken = opts.shouldReplaceCookieWithToken
 
-
   if (typeof generateId !== 'function') {
     throw new TypeError('genid option must be a function');
   }