这是一段基于cookie实现session的简单代码，还有很多地方不完善，可以参考express的实现

var sessions = {};
var session_key = 'freemind_session';
var EXPIRES = 20 * 60 * 1000;

//生成session的代码
var generate = function(){
    var session = {};
    session.id = (new Date()).getTime() + Math.random();
    session.cookie = {
        expires: (new Date()).getTime() + EXPIRES
    };
    sessions[session.id] = session;
    return session;
};

//请求到来时检查cookie的口令和服务端数据，如果过期，就重新生成，这部分只管服务端
exports.session =  function(req, res, next){
    var id = req.cookies[session_key];
    if(!id){
        req.session = generate();
    }
    else{
        var session = sessions[id];
        if(session){
            if(session.cookie.expires > (new Date()).getTime()){
                //更新超时时间
                session.cookie.expires = (new Date()).getTime() + EXPIRES;
                req.session = session;
            }
            else{
                //超时了，删除旧的数据，并重新生成
                delete sessions[id];
                req.session = generate();
            }
        }
        else{
            //如果session过期或者口令不对，重新生成session
            req.session = generate();
        }
    }
    var session = serialize(session_key, req.session.id, {path : '/'});
    res.setHeader('Set-Cookie', session);
    
    next();
};

function serialize(name, val, opt){
    var pairs = [name + '=' + val];
    opt = opt || {};
    if(opt.maxAge) pairs.push('Max-Age=' + opt.maxAge);
    if(opt.domain) pairs.push('Domain=' + opt.domain);
    if(opt.path) pairs.push('Path=' + opt.path);
    if(opt.expires) pairs.push('Expires=' + opt.expires.toUTCString());
    if(opt.httpOnly) pairs.push('HttpOnly');
    if(opt.secure) pairs.push('Secure');

    return pairs.join(';');
}