Did a lot. Tested SSE & started on socket.io, should prob kill s.io replace w/ ws

api/middleware/addIdToRequest.js

@@ -0,0 +1,23 @@
+const crypto = require("crypto");
+const httpContext = require("express-http-context");
+
+const addIdToRequest = (req, res, next) => {
+  try {
+    crypto.randomBytes(16, (err, buf) => {
+      if (err) {
+        // log err
+        id = null;
+      }
+      id = buf.toString("hex");
+
+      httpContext.set("sessionId", id);
+      next();
+    });
+  } catch (err) {
+    // log err
+    httpContext.set("sessionId", null);
+    next();
+  }
+};
+
+module.exports = addIdToRequest;

api/middleware/setupHeaders.js

@@ -12,7 +12,7 @@ const setupHeaders = (req, res, next) => {
   res.set("Access-Control-Allow-Headers", "Content-Type")
 
   // Security
-  res.set("X-Content-Type-Options", "nosniff");
+  // res.set("X-Content-Type-Options", "nosniff");
   res.set("X-XSS-Protection", "1; mode=block");
   res.set("X-Frame-Options", "SAMEORIGIN");
   res.set("X-DNS-Prefetch-Control", "off");