koa-session中app.keys什么意思？

Question

const session = require('koa-session');
const Koa = require('koa');
const app = new Koa();
app.keys = ['some secret hurr'];

const CONFIG = {
  key: 'koa:sess', /** (string) cookie key (default is koa:sess) */
  /** (number || 'session') maxAge in ms (default is 1 days) */
  /** 'session' will result in a cookie that expires when session/browser is closed */
  /** Warning: If a session cookie is stolen, this cookie will never expire */
  maxAge: 86400000,
  overwrite: true, /** (boolean) can overwrite or not (default true) */
  httpOnly: true, /** (boolean) httpOnly or not (default true) */
  signed: true, /** (boolean) signed or not (default true) */
  rolling: false, /** (boolean) Force a session identifier cookie to be set on every response. The expiration is reset to the original maxAge, resetting the expiration countdown. (default is false) */
  renew: false, /** (boolean) renew session when session is nearly expired, so we can always keep user logged in. (default is false)*/
};
app.use(session(CONFIG, app));

app.use(ctx => {
  // ignore favicon
  if (ctx.path === '/favicon.ico') return;

  let n = ctx.session.views || 0;
  ctx.session.views = ++n;
  ctx.body = n + ' views';
});

app.listen(3000);

如上代码，是koa-session官网文档代码，我特别想知道app.keys = ['some secret hurr']; 设置的是什么呢？里面内容可以随意写吗？

Answer 1

就是用来加密字符串，随便填。

Answer 2

内容可以随便填，一般是随机字符串。作用是用来加密cookie

Answer 3

signed = false 时，app.keys 不赋值没有关系；如果 signed: true 时，则需要对 app.leys 赋值，否则会报错。作用是将 cookie 的内容通过密钥进行加密，在 check 登录时，保证 cookie 内容未被修改，如果被修改了，则校验登录失败