Session: index.js - line 342 - why is it calling the 'createSession()' function on store?

[iddogino]

I am implementing a custom session store (on Mongo), and I was getting an error about a createSession() function not being implemented. I further investigated and found out that this method was not implemented by the MemoryStore as well, but that it was implemented in the /session/store.js file.

Is that a mistake?

Why not just put req.session = new Session(req, sess); there instead? It makes much more sense...

[dougwilson]

createSession is a mandatory method to include in your store implementation. You can choose to use the built-in Session class, but you can implement your own with the minimal methods and extras that pertain to your store.

Basically, it's because it's up to the sore to hand this module the object that will get set as req.session, if that's this module's default Session class or something else you want.

[dougwilson]

I further investigated and found out that this method was not implemented by the MemoryStore as well, but that it was implemented in the /session/store.js file.

When you read the source, you have to read the whole prototype chain, which would let you to yes, createSession is indeed implemented by MemoryStore, as it inherits from the Store prototype.

[dresende]

The documentation (Readme) does not explain correctly in my opinion. It should not say the store must extend from an EventEmitter but from the require("express-session").Store. This way you only need to implement the methods as described in the docs (get, set and destroy). Otherwise createSession is needed (which means you need to create resetMaxAge, touch, save, ... on req.session).

[dougwilson]

Thanks for the feedback, @dresende . Saying "the store must extend [...] from the require("express-session").Store" would be a complete lie, but we could update the documentation to say that you _could_ do this, if you wait, but if you do, your module _cannot depend on express-session_, rather it needs to take it in as an argument, which is what connect-redis does.

[dresende]

Yes, something should be changed to have a more clean documentation about making your own store. For me the dependency is not a problem because I'm using the module so I already depend on it. But yeah, that applies to people making modules like connect-redis.

[dwhieb]

For all practical purposes, the Store implementation does need to extend from store.js of express-session. This is because store.js itself depends on both session.js and cookie.js. So implementing one's own version of the methods in store.js also means reimplementing (or simply copying) session,js and cookie.js. The result is that a Store implementation either includes most of express-session's .js files (or some reimplementation thereof), or it must extend from store.js.

[caub]

But store#createSession is not listed in Readme, it's rather store#set that plays this role https://github.com/expressjs/session#storesetsid-session-callback

edit: it's supposed to set session in req object