Summary
The "remember me" option produces a shorter session than not selecting it, and standard sessions get no idle timeout at all.
On login, authenticateHandler does:
if (persistSession !== true) req.session.cookie.maxAge = null
else this.log('debug', 'NEW_SESSION', user._id)Session middleware is configured with cookie.maxAge = sessionLifespan (default 1h) and rolling: true.
Actual behaviour (verified)
- Standard login (no "remember me"):
maxAge is set to null, which makes it a browser-session cookie and nulls originalMaxAge, so rolling has nothing to slide. There is no idle timeout — the session lasts for the browser's lifetime (bounded only by the token's own expiry). The server-side store record also isn't bounded by sessionLifespan.
- "Remember me": keeps
maxAge = sessionLifespan (1h) with rolling, i.e. a 1h idle timeout.
So enabling "remember me" logs the user out sooner (1h idle) than leaving it off (browser lifetime). This is inverted, and sessionLifespan is doing double duty as both the idle window and the (non-existent) "remember me" duration.
Reproduced with a minimal express-session harness: the maxAge = null response emits a session cookie with no expiry, and subsequent rolling responses never re-add one; the maxAge kept path emits a persistent cookie whose expiry slides on each request.
Fix
Give the two cases distinct, correctly-ordered idle windows:
- Standard session keeps the default
sessionLifespan rolling idle window (no longer nulled).
- Add a
persistentSessionLifespan config (default 14d); "remember me" sets maxAge to it, so the session lasts longer and survives browser restarts.
Both paths now carry a non-null maxAge, so the session cookie's expiry also bounds the store record (no reliance on the store's default TTL). Net result: "remember me" is longer than a standard session, and every session has a rolling idle timeout.
Summary
The "remember me" option produces a shorter session than not selecting it, and standard sessions get no idle timeout at all.
On login,
authenticateHandlerdoes:Session middleware is configured with
cookie.maxAge = sessionLifespan(default1h) androlling: true.Actual behaviour (verified)
maxAgeis set tonull, which makes it a browser-session cookie and nullsoriginalMaxAge, sorollinghas nothing to slide. There is no idle timeout — the session lasts for the browser's lifetime (bounded only by the token's own expiry). The server-side store record also isn't bounded bysessionLifespan.maxAge = sessionLifespan(1h) with rolling, i.e. a 1h idle timeout.So enabling "remember me" logs the user out sooner (1h idle) than leaving it off (browser lifetime). This is inverted, and
sessionLifespanis doing double duty as both the idle window and the (non-existent) "remember me" duration.Reproduced with a minimal express-session harness: the
maxAge = nullresponse emits a session cookie with no expiry, and subsequent rolling responses never re-add one; themaxAgekept path emits a persistent cookie whose expiry slides on each request.Fix
Give the two cases distinct, correctly-ordered idle windows:
sessionLifespanrolling idle window (no longer nulled).persistentSessionLifespanconfig (default14d); "remember me" setsmaxAgeto it, so the session lasts longer and survives browser restarts.Both paths now carry a non-null
maxAge, so the session cookie's expiry also bounds the store record (no reliance on the store's default TTL). Net result: "remember me" is longer than a standard session, and every session has a rolling idle timeout.