I see that some session middlewares for connect/express do not
consider concurrent access to the session data in a meaningful way.
Global locks across processes are necessary! This is just one example
for a bigger problem.
Even in a single process, access to objects is not secure if you
change a central object with a function that is called inside an
event. If the function is async, then the object can be in a state
that is not correct. I am sure there are some modules that tackle this
problem within one process or across processes (using redis, for
example), that I don't know. I'd like to know more about solutions of
this kind.
This is my example considering object changes in a process
(explanation in German):
https://gist.github.com/1359300