connect-mongo: touch does not update session.cookie.expires
When resave: false and rolling: true then the store will update the top-level expires in the session database on each request. express-session will also update the cookie and send it with every response.
The problem is that the stored document at the path session.cookie.expires does not get updated, so it is out-of-sync with both the top level expires as well as the expires in the cookie.
Since the touch() implementation already sends a call to the database to update the top-level expires should it not also update session.cookie.expires ?
This is the configuration of express-session:
const store = new MongoStore({
mongooseConnection: db,
stringify: false,
});
session({
secret: 'some_secret',
resave: false,
rolling: true,
saveUninitialized: false,
cookie: {
maxAge: 60000,
secure: true,
httpOnly: true,
},
store,
})
The actual document saved to the store looks something like this:
{
"_id": "f2yQHE_BPi6UKV4pMuM7xluGPwQIhxIU",
"expires": {
"$date": "2020-02-03T15:23:54.646Z"
},
"session": {
"cookie": {
"originalMaxAge": 3599997,
"expires": {
"$date": "2020-02-03T15:04:06.890Z"
},
"secure": false,
"httpOnly": true,
"domain": null,
"path": "/",
"sameSite": null
},
"passport": {
"user": "someUser"
}
}
}
About this issue
- Original URL
- State: open
- Created 4 years ago
- Reactions: 5
- Comments: 34 (8 by maintainers)
Commits related to this issue
- fix: revert update session.cookie.expires when touch (#351) This commit revert changes made for #351. — committed to jdesboeufs/connect-mongo by mingchuno 3 years ago
Current Behavior
Expected Behavior (my opinion)
I performed a quick search on
expires. It seems like to me that it (the top levelexpires) is used to perform faster queries and should reflect the value in the cookie.resaveforces the session to be saved back to the session store. No mention ofexpiresReference: https://expressjs.com/en/resources/middleware/session.html
Happy to have a look at code if everyone agrees.
@YC I have just reverted it in
developbranch. https://github.com/jdesboeufs/connect-mongo/commit/82e1831b80fc5982b31a14b8db7dd0490d42d3a9 I will group the bug fixes and cut a release later.