Session: 1.16.0: TypeError: Cannot set property data of #<Object> which has only a getter

[oopyrj]

When launching 1.16.0 i get following exception:

TypeError: Cannot set property data of #<Object> which has only a getter
    at new Cookie (c:\project\node_modules\express-session\session\cookie.js:36:17)
    at MongoStore.Store.createSession (c:\project\node_modules\express-session\session\store.js:90:17)
    at c:\project\node_modules\express-session\index.js:479:15
    at promise.then.res (c:\project\node_modules\connect-mongo\src\index.js:10:20)
    at process._tickCallback (internal/process/next_tick.js:68:7)

NodeJS: 10.13

[dougwilson]

Hi @oopyrj ! So sorry for the issue you're having. Was this working in a prior version of this module? If so, is it possible you can either (a) track down which commit caused the regression or (b) provide a reproduction case so I can track it down to get a fix out?

[oopyrj]

Yes, it was working. I'll try tracking down first or will provide a repro case.

[dougwilson]

Thanks, I appreciate it 👍Just looking I didn't see any obvious regression. I am going to sleep where I live, but I'll be back in approx 8 hours. If you or anyone experiencing this has a fix or a reproduction case, I will be checking back here as soon as I'm awake to push out whatever changes are necessary asap.

[oopyrj]

https://github.com/expressjs/session/commit/ad717fe9aeaf9af016ab72cdaf25b490ebde8591

That's the offending commit. Most likely utils-merge have a check for not setting read-only properties and the code you replaced it with does not.

[dougwilson]

Thanks @oopyrj . So I cannot add the module back in. Taking a look at the code, it's identical as far as I can tell. What is the change needed in this module to adjust it to behave like it used to? Here is the utils-merge source code for reference: https://github.com/jaredhanson/utils-merge/blob/v1.0.1/index.js#L18-L20

[oopyrj]

Looks identical indeed. I'll try debugging a bit more.

[oopyrj]

Ok, i've dived a bit deeper and it turns out if your code is in separate module then setting a readonly property will not crash and will be skipped instead. So, essentially i tried moving:

for (var key in options) {
      this[key] = options[key]
    }

to a separate module and it stopped crashing.

Also, wanted to provide some background on why (most-likely, I'm not 100% sure) i'm getting this crash:

i a session config in store entry i have a following code:

store: new MongoStore({
                url
                serialize: x => x,
                unserialize: x => x
            }),

So, most likely serialize/unserialize is causing this. I'm not really sure this is correct approach to storing sessions but in our project we needed to be able to query for sessions so that's why sessions aren't stringified.

[s0b3ar]

check this PR https://github.com/expressjs/session/pull/649

[dougwilson]

Idk why I even bother helping if folks are going to thumbs down my comments.

[oopyrj]

Thanks a lot for a timely fix.