Lost data in session since 6.1.0
apydo opened this issue · comments
Our application uses express@4.17.2, express-session@1.17.2, ioredis@4.28.5 and connect-redis.
With connect-redis@6.0.0, everything is fine. We are able to save user data in the session after login and share this information between different routes in our application without any problem.
Since commit 0fbca57 something goes wrong.
User can connect with credentials to a page. That page launches several quick ajax calls to a different route. First ~9 calls works fine, all the stored session data is there.
Then session data gets lost for the next calls. All I can see is 'cookie' field in session but no any other fields previously stored in this session.
The cookie maxage is set to a week. I played a little bit with ttl option without any behaviour change.
The cookie name/value in browser does not change between valid calls and failed ajax calls. Only the session data gets lost.
Should I change something in our code or configuration to make it work again with connect-redis@6.1.0 or this is a bug ?
Thanks for diving in @apydo. I am going to revert commit this for now as I suspect you are not the only one experiencing this. I will publish a new version shortly.
Fix released in v6.1.1
This is fairly critical -- just bumped into this and I'm debugging it now.
It looks like ttl is getting set to NaN, because sess.cookie.expires is -- for some reason -- being set to an empty object.
NaN is < 0, so it's killing the session immediately.
Looking into it more now.
This is fairly critical
Agreed. This should be fixed for you in v6.1.1. Is there still an issue?
This is fixed in v6.1.1, however, I'm quite curious as to what caused it. I'm still looking through it now but it looks to be a fairly horrific race condition inside express-session.
The main reason I'm concerned is that the more I look into this bug the more it looks like it's still present, and is only not being race-triggered by sheer luck in the event-loop.
It seems to me like express-session is definitely not thread-safe.