Rolling session

[dang-1234]

Hello

I have the following config and every time I hit /sessionCheck, the session seems to be renewing (rolling?) even though I set the rolling prop to false,i.e

Everytime I hit /sessionCheck in the browser and hit refresh , the session seems to be going back to 120 seconds.

Is there something wrong in what I am trying to do? Thanks!

app.use(session({
  secret: 'xxxxxxxxxxx',
  name: 'custom',
  resave: false,
  saveUninitialized: true,
  rolling: false,
  cookie : { httpOnly: true, maxAge: 2*60*1000 }, 
}));

app.get('/sessionCheck', function(req, res){

    var fifteen_mins = 15*60*1000;

        if (req.session) {
        session_expire_time = Math.round(req.session.cookie.maxAge / 1000);
          if (session_expire_time <= 60) {
              req.session.cookie.maxAge = Math.round(req.session.cookie.maxAge) + fifteen_mins;
              res.send('Extended cookie to :'+ Math.round(req.session.cookie.maxAge)+' secs and sessID: '+req.session.id);
              res.end();
          } else {
            res.send('Not extended - good to go for :'+ Math.round(req.session.cookie.maxAge)+' secs and sessID: '+req.session.id);
              res.end();
          }

   }
});

[shepelevstas]

I have the same problem. I use Sequelize and I have set resave, saveUninitializedand rollingto false, but by every GET / request the session data is not only SELECTed, but also UPDATEd, thus making two query executions to database. How do I stop this? I have set maxAge to a week and dont need it updated every time.

[skarbovskiy]

this is happened because of https://github.com/expressjs/session/blob/master/index.js#L448 where isModified always returns true as session has _expires property which changes for every request. Don't think it is desirable behavior. Can provide PR fixing it if this repo is still maintained

[knoxcard]

I've set resave and rolling to true and everything appears to be great. Just throwing that out there, if you can get away with setting those two vars to true and it solves all your problems, why not?

Although, the false settings need to work as well, that just aint right.

[jfstephe]

From what I can tell (only had a brief look) I think it's the 'touch' functionality that's getting called regardless of rolling. Check out #557 and hopefully using that absolute expiry time will give you what you want.

[williamchong]

In my use case, I need less db i/o cost and quick api time, so I only want totouch the session expire at some specific endpoint. I already have resave saveUninitialized rolling all false, and the session in db is still updating for every (even GET) request. Is it possible to explicitly disable the auto-touch, and relies on req.session.touch() and store.touch manually?

[MauriPastorini]

@williamchong007 could you resolve this? I am having the same issue

[knoxcard]

I solved it by using the Redis session store here: https://github.com/tj/connect-redis

[williamchong]

I end up explicitly disabled touch() implementation of my store https://github.com/likecoin/liker-land/blob/721db847d0e8cdeaabbb968c903d80a70fae55cf/src/server/api/index.js#L42

[knoxcard]

@williamchong007 - nice solution. You can remove the following lines of code from your code.

const bodyParser = require('body-parser');
const cookieParser = require('cookie-parser');

[dougwilson]

Yes, this is an old issue, and I was just reading through the comments and there are a lot of different things being reported, with some things being fixed in this module now, and other being an issue with the store itself.

Because there are so many different things going on in this issue, I would encourage each and every one of you who are still having an issue to open a new issue with complete code and steps to reproduce the issue so we can debug through the issue. Please note the version of Node.js and this module you are using as well.