Proof of concept for #614 resolving

index.js

@@ -15,7 +15,8 @@
 
 var Buffer = require('safe-buffer').Buffer
 var cookie = require('cookie');
-var crypto = require('crypto')
+var omit = require('lodash.omit');
+var hasher = require('object-hash');
 var debug = require('debug')('express-session');
 var deprecate = require('depd')('express-session');
 var onHeaders = require('on-headers')
@@ -578,21 +579,8 @@ function getcookie(req, name, secrets) {
  */
 
 function hash(sess) {
-  // serialize
-  var str = JSON.stringify(sess, function (key, val) {
-    // ignore sess.cookie property
-    if (this === sess && key === 'cookie') {
-      return
-    }
-
-    return val
-  })
-
-  // hash
-  return crypto
-    .createHash('sha1')
-    .update(str, 'utf8')
-    .digest('hex')
+  var hashObj = omit(sess, 'cookie');
+  return hasher(hashObj, {respectType: false});
 }
 
 /**

package.json

@@ -14,6 +14,8 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",
+    "lodash.omit": "4.5.0",
+    "object-hash": "1.3.1",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.2",

test/session.js

@@ -916,6 +916,31 @@ describe('session()', function(){
       });
     });
 
+    it('should check session object modification correctly', function(done){
+      var callCount = 0;
+      var server = createServer(null, function (req, res) {
+        if (callCount % 2 === 0) {
+          req.session.user = { name: 'bob', id: 15 }
+        } else {
+          req.session.user = { id: 15, name: 'bob' }
+        }
+        callCount++;
+        res.end()
+      })
+
+      request(server)
+      .get('/')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, function(err, res){
+        if (err) return done(err);
+        request(server)
+        .get('/')
+        .set('Cookie', cookie(res))
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+      });
+    });
+
     it('should force cookie on unmodified session', function(done){
       var server = createServer({ rolling: true }, function (req, res) {
         req.session.user = 'bob'