search

koajs / generic-session

koa session store with memory, redis or others.
MIT License
414 stars 65 forks source link

koa.sid gets reset when Cache-Control:max-age=0 is sent? #118

Closed cbrwizard closed 7 years ago

cbrwizard commented 7 years ago

Hey, I am quite new to cookies and sessions handling in Node, so this might not be even related to this package. But I've noticed that when a request from frontend to my backend has a Request Header Cache-Control:max-age=0, a Response Header Set-Cookie:koa.sid=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; httponly is called, which resets the session for me. This happens when I edit the scripts files with Webpack.

I think I understand why a Request Header Cache-Control:max-age=0 is sent (well a file is new after all), but how can I disable the resetting of koa.sid cookie?

The funny thing is that koa.sid.sig doesn't get reset.

My config is:

const Koa = require('koa')
const convert = require('koa-convert')
const session = require('koa-generic-session')

const app = new Koa()
app.use(convert(session({
    cookie: {
      httpOnly: false,
    },
  })))
dead-horse commented 7 years ago

this module only reset the cookie when we set ctx.session=null, see https://github.com/koajs/generic-session/blob/master/lib/session.js#L215

can you check your code or debug into egg-generic-session to see what happened?

cbrwizard commented 7 years ago

@dead-horse thanks for a quick answer! I've solved it. generic-session wasn't the case. Firstly, the server was restarted with every code change - client included - by nodemon. Secondly, I've used a cookie store and after restarting the server, the session was gone. This was fixed by switching from cookie store to koa-redis. I will also tell nodemon to not restart the server on client code change.