Session: Use of resave and saveUninitialized configuration options

[parky128]

Hi,

I have just got started with using this library and so far have configured it with some basic defaults like so:

app.use(session({
  secret: 'some secret here',
  resave: false,
  saveUninitialized: false
}));

I see the session cookie returned in the browser, if I then clear out my cookies in the browser and make another request in the application, I don't see a new cookie returned.

If I remove the resave and saveUninitialized config options, I get warnings to say these options are deprecated and to provide values. If I leave out these config options, I do see cookies regenerated on subsequent requests in the browser after clearing the cookies.

The docs suggest setting these config options to false in most cases, so I am unsure what do set these to with the behaviour I am seeing where cookies are not getting regenerated.

I'm using the default memory store too, so is this a limitation of that? (I am planning on using a different store further down the line)

[gabeio]

So the saveUninitialized:false will not create a new session for the user if you don't add anything to the session like: req.session.something = <something> and thusly there is not cookie sent to the user. The down side to setting this to true is when your website gets tapped by bots you will create sessions for them in addition to users who only visit your front page and don't continue to login using up more sessions & memory...

[parky128]

Thanks @gabeio that all makes sense, and so I would certainly want to set saveUninitialized:false for my setup.

However, I am now trying to write some middleware that will redirect to a login route if no session is present, e.g.:

app.use(function(req, res, next){
  if(!req.session){
    res.redirect('/login');
  }
  next();
});

So I would have thought req.session will be nullundefined after setting saveUninitialized:false but it's still being set on an initial page visit and so no redirect occurs. I have not set any additional properties to the session object yet - have I misunderstood something here?

[joewagner]

@parky128 req.session is always going to be there. Try adding something to the session when they are authenticated, i.e. req.session.user = <some user object>
Then you can check for req.session.user

The passport module handles this for you, if you are interested.