Cookie should expire immediately when session is destroyed
- Dominant language
- JavaScript
- Stars
- 6.4k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
I believe that the session cookie should be forced to immediately expire when the session is destroyed (i.e. when the user logs out) on the server-side.
While the Session Store I am using is correctly handling this such that a subsequent request from the same client would create a new cookie/session, having the existing cookie for the now-destroyed session be forcibly expired keeps things much cleaner and clearer on the client-side.
Doing so also avoids wasting some bytes on the network bandwidth of _every_ outgoing request from the client by not including the irrelevant cookie. If the session has been destroyed but the cookie's normal expiration date has not yet been reached, this can contribute an undesirable amount of unnecessary upload bytes incurred from the client's outgoing requests due to always being required to include that irrelevant cookie in the `Cookie` header until it naturally expires.
When combined with my changes in PR #240 to fix the interaction between `rolling: true` and `saveUnitialized: false`, fixing this would keep things significantly cleaner on the client-side.
Contributor guide
Assessment
This issue has not been assessed yet.