This is a duplicate of expressjs/session#925 because Doug suggested the problem is more likely to be at the connect-mongo layer!
We're using express-session 1.17.2 with connect-mongo 4.6.0. Our app creates thousands of new sessions every day and we rarely have any issues. But sometimes I'll start getting this alert:
Error: TypeError: Cannot read property 'expires' of undefined
at MongoStore.Store.createSession (node_modules/express-session/session/store.js:87:29)
at inflate (node_modules/express-session/index.js:372:13)
at node_modules/express-session/index.js:499:11
at node_modules/connect-mongo/build/main/lib/MongoStore.js:222:17
at runMicrotasks (<anonymous>)
at processTicksAndRejections (internal/process/task_queues.js:95:5)
When I get the session id and look in mongo, the session field contains the string {}. Somehow it saves an empty json object with no cookie key. I need to manually delete the session so the user gets a new one and then it's resolved.
This happens maybe once a month or so. It's such a tiny fraction of all sessions, but it's still frustrating. It's got to be a race condition somewhere but I haven't been able to find anything obvious.
Has behavior like this been reported before? If not, is it possible to add error checking to avoid returning an invalid session that's missing its session.cookie?
This is a duplicate of expressjs/session#925 because Doug suggested the problem is more likely to be at the connect-mongo layer!
We're using express-session 1.17.2 with connect-mongo 4.6.0. Our app creates thousands of new sessions every day and we rarely have any issues. But sometimes I'll start getting this alert:
When I get the session id and look in mongo, the
sessionfield contains the string{}. Somehow it saves an empty json object with nocookiekey. I need to manually delete the session so the user gets a new one and then it's resolved.This happens maybe once a month or so. It's such a tiny fraction of all sessions, but it's still frustrating. It's got to be a race condition somewhere but I haven't been able to find anything obvious.
Has behavior like this been reported before? If not, is it possible to add error checking to avoid returning an invalid session that's missing its
session.cookie?