Skip to content

Commit 5a03dd1

Browse files
author
Paul Asjes
authored
Use a non-default ttl with iron-session (#1186)
## Description iron-session has a default ttl of 14 days, which is problematic in the edge case where a user has set their WorkOS sessions to expire > 14 days. In that scenario, iron-session will expire first, making unsealing impossible which means you can't refresh the session. This fix changes the default ttl to 0, which sets it to the max of ~10 years. ## Documentation Does this require changes to the WorkOS Docs? E.g. the [API Reference](https://workos.com/docs/reference) or code snippets need updates. ``` [ ] Yes ``` If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.
1 parent f3eb43c commit 5a03dd1

File tree

2 files changed

+14
-2
lines changed

2 files changed

+14
-2
lines changed

src/common/iron-session/edge-iron-session-provider.ts

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,13 @@ import {
1111
export class EdgeIronSessionProvider extends IronSessionProvider {
1212
/** @override */
1313
async sealData(data: unknown, options: SealDataOptions): Promise<string> {
14-
return sealData(data, options);
14+
// The iron-session default ttl is 14 days, which can be problematic if the WorkOS session is configured to be > 14 days.
15+
// In that case the session expires and can't be refreshed, so we set the ttl to 0 to set it to the max possible value.
16+
const sealOptions = {
17+
...options,
18+
ttl: 0,
19+
};
20+
return sealData(data, sealOptions);
1521
}
1622

1723
/** @override */

src/common/iron-session/web-iron-session-provider.ts

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,13 @@ import {
1111
export class WebIronSessionProvider extends IronSessionProvider {
1212
/** @override */
1313
async sealData(data: unknown, options: SealDataOptions): Promise<string> {
14-
return sealData(data, options);
14+
// The iron-session default ttl is 14 days, which can be problematic if the WorkOS session is configured to be > 14 days.
15+
// In that case the session expires and can't be refreshed, so we set the ttl to 0 to set it to the max possible value.
16+
const sealOptions = {
17+
...options,
18+
ttl: 0,
19+
};
20+
return sealData(data, sealOptions);
1521
}
1622

1723
/** @override */

0 commit comments

Comments
 (0)