Session resets when navigating pages

[ganna-shmatova]

I posted my problem here but did not get much help: http://stackoverflow.com/questions/24417469/express-session-is-undefined-when-accessing-external-website

I'm not quite sure what I did wrong?

Any help would be appreciated.

[jonathanong]

off the top of my head, you might want to put the session middleware below any static middleware.

[dougwilson]

You are also using a memory store. If you host is running multiple copies of your app, you're going to have a problem with your sessions constantly disappearing.

[kylejeske]

Using version: '1.5.2'

I've been having this same problem with MongoDB stored sessions.

I've been trying to resolve a session remaining stored (with passport) for nearly 24 hours. As of now, with the secret key set, it's generating a new session ID on each page resource load.

    // The cookieParser should be above session
    //app.use(cookieParser());
    app.use(cookieParser('test123));
   ...
    app.use(session({
        secret: 'test123',
        store: new mongoStore({
            db: db.connection.db,
            collection: config.sessionCollection
        })
    }));

{ "_id" : "kMCS7m45ruje7kdTrgUu4QnrE6_GQ5FG", "session" : "{\"cookie\":{\"originalMaxAge\":86400000,\"expires\":\"2014-06-28T13:06:56.494Z\",\"secure\":false,\"httpOnly\":true,\"domain\":\".mine.io\",\"path\":\"/\"},\"passport\":{\"user\":\"5367915f19e3b069a1b23cf3\"}}", "expires" : ISODate("2014-06-28T13:06:56.494Z") }
{ "_id" : "ZC23fUMBTwXiIVlg47KoRywbF7LIhPan", "session" : "{\"cookie\":{\"originalMaxAge\":86400000,\"expires\":\"2014-06-28T13:07:06.876Z\",\"secure\":false,\"httpOnly\":true,\"domain\":\".mine.io\",\"path\":\"/\"},\"passport\":{}}", "expires" : ISODate("2014-06-28T13:07:06.876Z") }

GET /[...].html 304 5.517 ms - -
GET /[...].html 304 3.417 ms - -
GET /[...].html 304 6.117 ms - -
GET /[...].html 304 2.517 ms - -
GET /[...].html 304 2.517 ms - -
GET /[...].html 304 3.517 ms - -
SessionID: 3ArsNPYtdHme57ObgxKSvgBTQ9YKwZnj
SessionID: 80XZ2S0qHXZFyfQJtwtt4TAVThx-ZnYa
SessionID: eFd54pzHrmR6oKh7x2-QJzdy3IpBrp0E
SessionID: N2vs_TcG8rZYKpKm8xk0qtGdSPfgffHA
SessionID: RRjxUgx6avIvlxkLZ7PgAw7NP7rXsBWW
SessionID: q_8M9_QvLU49iVMyh_xY3OvhvJUbcCub

[jonathanong]

could be a mongodb session bug. i remember using one of them a while ago and hit the same issue. the other mongodb session plugin works fine.

[kylejeske]

I thought it might have been MongoDB related too but it still does it with:

    app.use(session({
        secret: 'test123',
        cookie: {}
    }));

Also, this all worked before I upgraded and I have a production version running before the upgrade.

[ganna-shmatova]

I did two things and I'm not sure which one fixed it:

I moved express.static declaration to the beginning of the file.
I also set my cookieParser secret the same as my express session secret.

Also, I'm using memorystore because this is the only node server that will be running on that server. So it isn't conflicting...

[jonathanong]

probably the first, which i stated above :)

[ganna-shmatova]

Out of curiousity, why would the static fix it? I don't think I understand it

[jonathanong]

basically, it'll create a new session for all concurrent requests, so they end up overwriting each other. when the static middleware is above the session middleware, the static requests never hit the session middleware, so no new session is created.

this is a bug with this middleware since it should only create a session if it's used or changed.

[ganna-shmatova]

Well, then this ticket is valid...

[jonathanong]

yup. i'm pretty sure i had an issue open for this, not sure what happened to it

[dougwilson]

it should only create a session if it's used or changed.

In your session settings, set saveUninitialized: false. It is defaulting to true for backwards-compatibility until the net major.