Clearing sessions in mongodb, expressjs, nodejs

Question

My configuration:

app.configure(function(){
    app.set('views', __dirname + '/views');
    app.set('view engine', 'jade');
    app.use(express.bodyParser());
    app.use(express.cookieParser());
    app.use(express.session({
        secret: 'MY SECRET',
        store: new MongoStore({
            db: 'MY SESSION DB',
            host: 'localhost',
            port:88888
        })
    }));
    app.use(everyauth.middleware());
    app.use(express.methodOverride());

    app.use(app.router);
});

app.configure('dev', function(){
    app.use(express.errorHandler({ dumpExceptions: true, showStack: true }));
    appPort = config.port; //Setting PORT to 8888 in dev mode.
    app.use('/public', express.static(__dirname + '/public'));
});

app.configure('production', function(){
    app.use(express.errorHandler());
    appPort = config.port;
    //Set cache-header-expires to 1 day
    var oneDay = 86400000;
    //app.use('/public', express.static(__dirname + '/public'));
    app.use('/public',express.static(__dirname + '/public', { maxAge: oneDay }));
});

Now, I have a 'logout' link which goes to /logout on my app.

AFAIK, express automatically takes care of clearing sessions on logout. But with my config, I dont think its doing that. For example, A custom variable attached to session

req.session.custom

still holds after logout. However,

req.session.auth

is cleared after logout.

The number of session object in my MongoDb store are only incrementing over time. I am using everyauth as well.

What am I missing or doing wrong?

score 15 · Accepted Answer · answered Jun 30 '12 at 12:56

15

If you want to fully clear the session for the user on logout you can call req.session.destroy() from your everyauth.everymodule.handleLogout function. Only req.session.auth is cleared when you call req.logout().

answered Jun 30 '12 at 12:56

JohnnyHK

305,182
66
621
471

1

How can I go about deleting the object in my Mongo session store as well on logout? – Rajat Jun 30 '12 at 13:26
3

`req.session.destroy()` deletes the session object from your store. – JohnnyHK Jun 30 '12 at 14:13
I dont think req.session.destroy() is clearing it. Both before and after logout, count() on the store is 1 when I test. Any clue? – Rajat Jul 04 '12 at 05:06
5

Does your logout redirect to a login page? That would then create a new session to replace the one you just destroyed during logout and make it look like nothing changed. – JohnnyHK Jul 04 '12 at 13:47
1

You are right. Its creating a new one. I check the session id. Thanks for pointing that out. – Rajat Jul 04 '12 at 18:08
why is it creating a new session in mongo store.Is there any way to prevent it when i am redirected to login again. – LoneRanger Jun 07 '15 at 05:43

score 3 · Answer 2 · edited Mar 09 '21 at 08:46

why is it creating a new session in mongo store.Is there any way to prevent it when i am redirected to login again. – loneranger Jun 7 '15 at 5:43

There's a saveUninitialized option to prevent the session to be saved if it does not contain any data.

app.use(session({
    secret: 'secret123',
    store: new MongoStore({
        mongooseConnection: mongoose.connection,
        ttl: 60 * 30 // half hour
    }),
    saveUninitialized: false
}));

Clearing sessions in mongodb, expressjs, nodejs

2 Answers2