@fastify/session v10.0.0 or What is missing for the next version?

[Uzlopak]

Prerequisites

• [X] I have written a descriptive issue title
• [X] I have searched existing issues to ensure the issue has not already been raised

Issue

Alot of work has been invested into this plugin. But are we now feature complete? I have the feeling that we are so close to have it the biggest issues fixed.

On one hand I am kind of exhausted by the work on this plugin. So basically I read the unit tests, and dont understand them anymore. And on the other hand, I really want that we get a release soon.

So can we please consolidate the open issues in this thread? Or open new issues.

It would be good if you would read critically the code too. Maybe you see something we did overlook? Or is maybe totally wrong in the first place?

So give please feedback.

So I start, and if I find more cases or if you find some then please post them. I would add them to this list.

[ ] check if rolling is working as expected

[Uzlopak]

pinging people, who are maybe willing to give feedback: @rclmenezes @SimenB @cameronmbell @sarneeh @m0dch3n

[rclmenezes]

On one hand I am kind of exhausted by the work on this plugin. So basically I read the unit tests, and dont understand them anymore. And on the other hand, I really want that we get a release soon.

Totally agree! Honestly, I've been following this repo and it's been much cleaner to work with: https://github.com/mgcrea/fastify-session

I also experimented with importing Store and Session from express-session and plugging it in via fastify hooks. That way, we can make a separate repo for users who want express compatibility and we can stop worrying about replicating express-session's behavior here.

Anyway, I'm off-topic. The other things I think we should do:

• [x] We should save maxAge as originalMaxAge in session.cookie. This would allow services using express-session and services using @fastify/session to use same session store. It's important to me personally (at work I'm trying to migrate us off Express), so I'll work on this next.
• [x] We should probably try making rolling work as expected. I don't think the option does anything anymore!
• [x] Make sure saveUninitialized + maxAge work as expected
• [x] cookie.maxAge should have priority over cookie.expires. In our code here, we don't do that even though our docs say otherwise. I haven't made an issue yet because I haven't had time to think through if there's a bug here, but it smells suspicious.
• [x] Minor refactor -- we can rm maxAge as a key here since we can use session.cookieOpts.maxAge instead.

[rclmenezes]

Also -- thank you @uzlopak for all your work so far!

[SimenB]

134 and #143 are the main breaking things I was waiting on, very happy to see them land 😀 Beyond that I don't really know what's missing (@rclmenezes's list looks good). As mentioned in https://github.com/fastify/session/pull/101#issuecomment-1191314027 we had issues with the data persisted in the session, but I still haven't found the time to dig into it. And regardless, I doubt the fix will be semver major (it might even have gotten fixed along the way if we're lucky 🙂)

[climba03003]

I would like to know how many task are left? If there are no pending task or new comment, I will release a new major on this Friday 9 / 9.

Then, I will cut a next branch to prevent staling lots of breaking changes in master.

[SimenB]

Probably just missing https://github.com/fastify/session/pull/154?

[Uzlopak]

It seems Feature complete. But i would prefer not to release now. I want to just do final check. So i think friday is a good finish Line

[Eomm]

Are we ready to land?

[Uzlopak]

Please wait. I have found three small issues. PR are incoming

[Uzlopak]

I provided all three PRs.

168

169

170

After that I will not touch this plugin for a while :D

[mcollina]

@Uzlopak could you sum up in a paragraph all the changes you did for this release? A long list of PRs might be hard to digest.

[Uzlopak]

Based on the auto generated release notes I modified them. I thought you maybe want to copy paste that.

---

Relevant Changes

• express-session compatibility: Add cookiePrefix as an option to allow for compatibility with express-session by @rclmenezes in https://github.com/fastify/session/pull/113
• express-session compatibility: Move expires from session to session.cookies by @rclmenezes in https://github.com/fastify/session/pull/120
• feat: use @fastify/cookie-signer-logic for signing and unsigning by @Uzlopak in https://github.com/fastify/session/pull/129
• express-session compatibility: prevent sessionId from being stored in the sessionStore by @rclmenezes in https://github.com/fastify/session/pull/134
• express-session compatibility: prevent encryptedSessionId from being stored in the sessionStore by @Uzlopak in https://github.com/fastify/session/pull/143
• bugfix: Resave session cookie if saveUninitialized is false and rolling is true by @rclmenezes in https://github.com/fastify/session/pull/149
• bugfix: use maxAge over expires by @Uzlopak in https://github.com/fastify/session/pull/152
• bugfix: Make it possible to call save() in decryptSession by @Uzlopak in https://github.com/fastify/session/pull/161
• express-session compatibility: Implement originalMaxAge by @rclmenezes in https://github.com/fastify/session/pull/162
• Remove deprecation notice for fastify-Instance decryptSession by @Shrihari-Prakash in https://github.com/fastify/session/pull/164
• typings: add typings for decryptSession by @Uzlopak in https://github.com/fastify/session/pull/165
• security: verify path of cookie/session by @Uzlopak in https://github.com/fastify/session/pull/169

What also Changed

• feat: Update benchmark. by @ShogunPanda in https://github.com/fastify/session/pull/91
• ci: migrate to fastify reusable workflow by @Fdawgs in https://github.com/fastify/session/pull/90
• build(deps-dev): bump fastify-cookie from 5.6.1 to 5.7.0 by @dependabot in https://github.com/fastify/session/pull/92
• docs(readme): remove snyk badge by @Fdawgs in https://github.com/fastify/session/pull/93
• chore(.gitignore): use updated skeleton template by @Fdawgs in https://github.com/fastify/session/pull/96
• build(deps-dev): bump @types/node from 17.0.45 to 18.0.0 by @dependabot in https://github.com/fastify/session/pull/97
• build(deps-dev): bump tsd from 0.20.0 to 0.21.0 by @dependabot in https://github.com/fastify/session/pull/98
• build(deps-dev): bump tsd from 0.21.0 to 0.22.0 by @dependabot in https://github.com/fastify/session/pull/102
• style(types/types.test-d.ts): explicitly declare semicolon by @Fdawgs in https://github.com/fastify/session/pull/103
• refactor: use optional chaining by @Fdawgs in https://github.com/fastify/session/pull/104
• build(deps): bump fastify-plugin from 3.0.1 to 4.0.0 by @dependabot in https://github.com/fastify/session/pull/105
• remove metadata.js by @Uzlopak in https://github.com/fastify/session/pull/107
• separate lint from npm test script, activate lint and license-check in ci pipeline by @Uzlopak in https://github.com/fastify/session/pull/108
• refactor unit tests, replace ava with tap, remove undici and typescript as devDependencies by @Uzlopak in https://github.com/fastify/session/pull/109
• move benchmark to corresponding folder, slim it down by @Uzlopak in https://github.com/fastify/session/pull/110
• tap should only run test.js files by @Uzlopak in https://github.com/fastify/session/pull/115
• Clean up tests by @rclmenezes in https://github.com/fastify/session/pull/117
• Add missing documentation for README.md by @rclmenezes in https://github.com/fastify/session/pull/116
• Simplify shouldSaveSession code a little bit by @rclmenezes in https://github.com/fastify/session/pull/119
• simplify callback typing by @Uzlopak in https://github.com/fastify/session/pull/124
• perf: improve idgenerator (about 25-30 % faster) by @Uzlopak in https://github.com/fastify/session/pull/123
• chore: remove addDataToSession by @Uzlopak in https://github.com/fastify/session/pull/127
• add autocannon example by @Uzlopak in https://github.com/fastify/session/pull/128
• move signer require into ensureDefaults by @Uzlopak in https://github.com/fastify/session/pull/130
• fix unit test by @Uzlopak in https://github.com/fastify/session/pull/132
• fix lgtm alert by @Uzlopak in https://github.com/fastify/session/pull/133
• simplify getExpires, export getExpires from cookie by @Uzlopak in https://github.com/fastify/session/pull/135
• remove internal used session restore() function by @Uzlopak in https://github.com/fastify/session/pull/136
• remove sinon as dev dependency by @Uzlopak in https://github.com/fastify/session/pull/139
• add redis example by @Uzlopak in https://github.com/fastify/session/pull/142
• add pre-commit by @Uzlopak in https://github.com/fastify/session/pull/145
• add unit test for maxAge by @Uzlopak in https://github.com/fastify/session/pull/144
• create a separate unit test file for memorystore by @Uzlopak in https://github.com/fastify/session/pull/150
• rename secret.test.js to fastifySession.checkOptions.test.js and refactor it by @Uzlopak in https://github.com/fastify/session/pull/151
• build(deps-dev): bump tsd from 0.22.0 to 0.23.0 by @dependabot in https://github.com/fastify/session/pull/153
• rename session to fastifySession by @Uzlopak in https://github.com/fastify/session/pull/160
• simplify cookie handling by @Uzlopak in https://github.com/fastify/session/pull/166
• ensure that secure false is not overwritten by null when stored in the sessionStore by @Uzlopak in https://github.com/fastify/session/pull/168
• minor cosmetic change by @Uzlopak in https://github.com/fastify/session/pull/167

New Contributors

• @ShogunPanda made their first contribution in https://github.com/fastify/session/pull/91
• @Uzlopak made their first contribution in https://github.com/fastify/session/pull/107
• @rclmenezes made their first contribution in https://github.com/fastify/session/pull/117
• @Shrihari-Prakash made their first contribution in https://github.com/fastify/session/pull/164

Full Changelog: https://github.com/fastify/session/compare/v9.0.0...v10.0.0

[climba03003]

Released 16ef7eb6c79ecc2342b0611c3aebb2512ca0c24c

[climba03003]

I have added a Notable Changes section on the release notes.

@Uzlopak Can you helps me to check if anything missing.