Ndtyjky

I set the session timeout to 30 minutes. While I am still active, req.session.user is deleted after 30 minutes. However, the session is still alive. Here's my config (i'm using express-session and passport.js):

app.use(session({

    store: new RedisStore({client: <my client>, disableTTL: true}),

    secret: <some_secret>,

    resave: true,

    saveUninitialized: false,

    cookie: {maxAge: 1800000}

}));



app.use(passport.initialize());

app.use(passport.session());



// Are these serializer/deserializer needed?

passport.serializeUser((user, done) => {

    done(null, user);

});

passport.deserializeUser((user, done) => {

    done(null, user);

});

In login:

router.post('/login', (req, res, next) => {

    passport.authenticate('ldapauth', {session: false}, (err, user, info) => {

        ...

        if (user) {

            req.session.user = {email: req.body.username};

        }

        next();

    })(req, res);

});

The verify code is like this:

isLoggedIn() {

    if (req.session && req.session.user) {

        return true;

    }

    return false;

}

I set the req.session.user to some object after I successfully logged in.

So, after 30 minutes, req.session.user is deleted, but req.session is still there and keeps on incrementing the expiry date since I am still actively working on the page.

Why is req.session.user deleted after 30 minutes? I thought passport rides on the session by express?

* UPDATE *
At first, I thought the expiry is incrementing, but it's not. Previously, I set resave: false. Then when I log the session, the expiry is always the same:

Session {

    cookie:

         { path: '/', _expires: <some date>.... }

    user:

         { email: <the one i set before>, sessionId: <some id> } }

Then after 30 minutes, the user is deleted. Only at this point, the expiry begins incrementing.

Session {

    cookie:

         { path: '/', _expires: <some date>.... }

Then I read something about the touch method that express-session calls. The documentation said that if the store implements this touch method, then it's ok to set the resave: false. So, thinking that redis may not be implementing this method, I tried setting resave: true. Then when I log the session, I noticed that the expiry is now incrementing, compared to the previous that it only increments after user is deleted. However, after 30 minutes, again the user key is deleted.

Then with niry's suggestion, I set the disableTTL: true. Again, the same thing happened.

In redis, I try to mget the key. Before the 30 minutes end, the expiry in redis is incrementing:

127.0.0.1:6379> mget sess:<some id>

1) "{"cookie":{"originalMaxAge":1800000,"expires":"2018-11-15T06:04:26.994Z","httpOnly":true,"path":"/"},"user":{"email":"test@email.com","sessionId":"some session id"}}"

Then after 30 minutes, I looked at redis, the session key is still there but it stopped incrementing the expiry. While, req.session still increments the expiry but with the user property deleted.

Why is req.session.user deleted after 30 minutes?

Because the maxAge option of cookie is set to 1800000 ms which is 30 minutes. So the browser ( or whatever client you are using ) will delete the cookie after 30 minutes.

A session is some information you want to persist over subsequent requests. Generally, a session has an ID(sessionID) and associated payload. When you do req.session = { ... }, the express-session middleware would take the object, generate an ID and save it in the store you specified. (RedisStore in your case). So now your "database" has the mapping of sessionID and the payload.

Cookies are something that once sent from the server, they would be forwarded every-time to that server (to that domain) for each subsequent request until they are expired. Note that once the cookie is received, it is the client's job to manage it. The generated sessionID along with the signature is sent to the client in the cookie.

Once the cookie is saved on your client. It will forwarded with the next request.
When your express-session middleware sees the cookie, it extracts the sessionID from the cookie, and try to look for the corresponding payload in the store (RedisStore in your case). The payload is then set to req.session along with other information.

Once the expiry time is reached, the client will delete the cookie. Thus, request from that client would not have the cookie. Because the cookie is not there, the express-session will not be able to set the req.session and you would think that the user is logged out. Note that, the store still contains the sessionID, payload mapping which will be deleted according to ttl config of store.

I think the confusion arose in the first place is because of session.cookie field. session.cookie will always be there because of the express-session middleware.

If you want to see the actual cookies received in the request, try cookie-parser middleware.

I am attaching sample code to tinker. The set-cookie endpoint will set the cookie which expires in 20 seconds. get-cookie endpoint will get the cookie and session data.

Hope this will help!

const express = require("express");

const session = require("express-session");

const cookieParser = require("cookie-parser");

const FileStore = require("session-file-store")(session);

const path = require("path");



const app = express();



app.use(express.json());



app.use(cookieParser());

app.use(

    session({

        secret: "top secret!",

        resave: false,

        rolling: true,

        saveUninitialized: false,

        cookie: {

            maxAge: 20 * 1000

        },

        name: "demo",

        store: new FileStore({

            path: path.join(__dirname, "../sessions"),

            retries: 1,

            fileExtension: ".json"

        })

    })

);



app.use("/set-cookie", (req, res) => {

    req.session.payload = { foo: "bar", timestamp: new Date().toISOString() };

    res.json({ message: "done" });

});



app.use("/get-cookie", (req, res) => {

    res.json({

        sessionID: req.sessionID,

        session: req.session,

        cookies: req.cookies,

        timestamp: new Date().toISOString()

    });

});



app.listen(3000, err => {

    if (err) {

        throw err;

    }

    console.log("demo app listening on port 3000");

});

UPDATE
Based on the comments, what you are looking for the rolling option. Once you set the rolling: true in express-session, the session will be updated for every request. And user will be logged out after maxAge IDEAL time.

I have updated the code.