pallets-eco / flask-session

Server side session extension for Flask
https://flask-session.readthedocs.io
BSD 3-Clause "New" or "Revised" License
488 stars 236 forks source link

DynamoDB retrieve session does not check for expiration time #240

Closed MauriceBrg closed 2 months ago

MauriceBrg commented 2 months ago

The DynamoDBSessionInterface relies on DynamoDB to expire outdated sessions through the TTL feature (unless they're explicitly deleted). Unfortunately the TTL feature is asynchronous and can sometimes take several days to delete an item.

Items with valid, expired TTL attributes may be deleted by the system at any time, typically within a few days of their expiration. You can still update the expired items that are pending deletion, including changing or removing their TTL attributes. While updating an expired item, we recommended that you use a condition expression to make sure the item has not been subsequently deleted. — docs (emphasis mine)

That's why we should only request the item if its expiration time is after the current time.

This can be achieved using a ConditionExpression when calling get_item. (Isn't supported for GetItem)