feat: enforce secret requirement for session creation

Author: bjohansebas

index.js

@@ -143,8 +143,8 @@ function session(options) {
     secret = [secret];
   }
 
-  if (!secret) {
-    deprecate('req.secret; provide secret option');
+  if (secret === undefined) {
+    throw new Error('secret is required for sessions');
   }
 
   // notify user that this store is not
@@ -207,7 +207,7 @@ function session(options) {
 
     // backwards compatibility for signed cookies
     // req.secret is passed from the cookie parser middleware
-    var secrets = secret || [req.secret];
+    var secrets = secret;
 
     var originalHash;
     var originalId;

test/session.js

@@ -35,20 +35,8 @@ describe('session()', function(){
     .expect(200, done)
   })
 
-  it('should error without secret', function(done){
-    request(createServer({ secret: undefined }))
-    .get('/')
-    .expect(500, /secret.*required/, done)
-  })
-
-  it('should get secret from req.secret', function(done){
-    function setup (req) {
-      req.secret = 'keyboard cat'
-    }
-
-    request(createServer(setup, { secret: undefined }))
-    .get('/')
-    .expect(200, '', done)
+  it('should reject without secret', function(){
+    assert.throws(session.bind(null, { secret: undefined }), /secret.*required/)
   })
 
   it('should create a new session', function (done) {