expressjs / expressjs/session

Cookie should expire immediately when session is destroyed

Open
#241 25 comments 13 reactions 0 assignees View on GitHub
ideas
Dominant language
JavaScript
Stars
6.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I believe that the session cookie should be forced to immediately expire when the session is destroyed (i.e. when the user logs out) on the server-side.

While the Session Store I am using is correctly handling this such that a subsequent request from the same client would create a new cookie/session, having the existing cookie for the now-destroyed session be forcibly expired keeps things much cleaner and clearer on the client-side.

Doing so also avoids wasting some bytes on the network bandwidth of _every_ outgoing request from the client by not including the irrelevant cookie. If the session has been destroyed but the cookie's normal expiration date has not yet been reached, this can contribute an undesirable amount of unnecessary upload bytes incurred from the client's outgoing requests due to always being required to include that irrelevant cookie in the `Cookie` header until it naturally expires.

When combined with my changes in PR #240 to fix the interaction between `rolling: true` and `saveUnitialized: false`, fixing this would keep things significantly cleaner on the client-side.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.