expressjs / expressjs/session

Duplicate session cookie when changing configuration

Open
#1,010 1 comment 0 reactions 0 assignees View on GitHub
ideas
Dominant language
JavaScript
Stars
6.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I noticed that changing the configuration in production/deployed mode of express-session cookies can lead to duplicate connect.sid cookie stored in the browser with the old and the new configuration - which can be very problematic to retrieve the right session afterwards.

New configuration :
```
store: redisStore,
secret: envConfig.OTHER_TOKEN_SECRET,
resave: false,
saveUninitialized: true,
cookie: {
secure: envConfig.ENV === 'local' ? false : true,
httpOnly: true,
sameSite: envConfig.ENV === 'local' ? 'lax' : 'none',
maxAge: 60 * 60 * 1 * 1000, // 1 hour
partitioned: envConfig.ENV === 'local' ? false : true,
},
```

Old configuration :
```
store: redisStore,
secret: envConfig.OTHER_TOKEN_SECRET,
resave: false,
saveUninitialized: true,
cookie: {
secure: true,
httpOnly: true,
sameSite: envConfig.ENV === 'local' ? 'lax' : 'none',
},
```

![WhatsApp Image 2024-12-27 at 10 40 40](https://github.com/user-attachments/assets/6b2cbec0-b4ed-4b07-8cb4-38c97d0b9456)

To fix this, I had no choice but to change the name of the session cookie stored in the browser.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.