expressjs / session / 854

100%

Pull #531

travis-ci

Only touch sessions in the store when rolling sessions are enabled

- Currently, disabling rolling sessions suppresses unmodified
  cookies being sent back to the client (line 447). However, the
  session is "touched" in the store regardless of whether rolling
  sessions are enabled (line 339).

- This results in the expiry time in the cookie and in the
  persistent session deviating. Specifically, the expiry of the
  persistent session is pushed back on each and every request
  whereas the cookie expiry is only updated if the request
  changes the session.

- This prevents the use case of a "session ping" request that is
  sent by the client to test if their session is still valid. We
  have achieved this by turning off rolling sessions and placing
  the handling of the ping early in the express stack. A stack
  entry is then placed after the ping handling to make a benign
  change to the session to cause it to be stored, in effect,
  touching the session much like rolling sessions. An example
  router might look like (using passport with disabled rolling
  sessions):

    router.get('/ping', function (req, res, next) {
        if (!req.isAuthenticated()) {
            res.sendStatus(403);
        }
        else {
            res.sendStatus(200);
        }
    });

    router.use(function (req, res, next) {
        // Push back session expiry and make benign change to
        // force persistent storage.
        req.session.cookie.maxAge = 3600;
        req.session._dummy = req.session._dummy ? (req.session._dummy + 1) : 0;
        next();
    });

- This appears to work from a client perspective as the cookie
  expires at the appropriate time. However, the session expiry
  in the store is always pushed back, even for ping requests.
  This means that from a server perspective the session is
  still valid for some period after the cookie expiry. The
  store expiry therefore cannot be trusted or used to identify
  expired sessions in the store for purg... (continued)

218 of 239 branches covered (91.21%)

4 of 4 new or added lines in 1 file covered. (100.0%)

389 of 403 relevant lines covered (96.53%)

646.6 hits per line