hoangvvo / hoangvvo/next-session

Session stores expect maxAge to be in milliseconds not seconds

Open
#369 3 comments 3 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
359
Forks
24
PR merge metrics
No merged PRs in 30d

Description

Session stores that are made for `express-session` use milliseconds in `maxAge`, and because `next-session` uses seconds instead the session gets dropped from the session store well before it should and well before the cookie expires. For example, putting 86400 (1 day) into `maxAge` results in the session expiring in about a minute.

Using seconds in `next-session` should not be a problem, but passing this value to the session store might have this affect based on what the session store uses to calculate the expiration date. The ones that base their calculations on `maxAge` are affected, the ones that use the precalculated date provided in `expires` are not. So, for example [connect-redis](https://github.com/tj/connect-redis) works fine. But so far, I tested [connect-sqlite3](https://github.com/rawberg/connect-sqlite3) and [better-sqlite3-session-store](https://github.com/TimDaub/better-sqlite3-session-store) and both of them have this problem.

Here is the documentation for `express-session` covering the `maxAge` option: https://expressjs.com/en/resources/middleware/session.html#cookiemaxage

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.