connect-mongo
Advanced tools
Changelog
[4.2.2] - 2021-03-02
kruptein to v3.0.0 and change encodeas to base64Readme
MongoDB session store for Connect and Express written in Typescript.
Breaking change in V4 and rewritten the whole project using Typescript. Please checkout the migration guide and changelog for details.
npm install connect-mongo
yarn add connect-mongo
5.0>= 3.03.2+For extended compatibility, see previous versions v3.x. But please note that we are not maintaining v3.x anymore.
Express 4.x, 5.0 and Connect 3.x:
const session = require('express-session');
const MongoStore = require('connect-mongo').default;
app.use(session({
secret: 'foo',
store: MongoStore.create(options)
}));
In many circumstances, connect-mongo will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.
Alternatively, you can configure connect-mongo to establish a new connection.
MongoDB connection strings are the best way to configure a new connection. For advanced usage, more options can be configured with mongoOptions property.
// Basic usage
app.use(session({
store: MongoStore.create({ mongoUrl: 'mongodb://localhost/test-app' })
}));
// Advanced usage
app.use(session({
store: MongoStore.create({
mongoUrl: 'mongodb://user12345:foobar@localhost/test-app?authSource=admin&w=1',
mongoOptions: advancedOptions // See below for details
})
}));
In this case, you just have to give your MongoClient instance to connect-mongo.
/*
** There are many ways to create MongoClient.
** You should refer to the driver documentation.
*/
// Database name present in the connection string will be used
app.use(session({
store: MongoStore.create({ clientPromise })
}));
// Explicitly specifying database name
app.use(session({
store: MongoStore.create({
clientPromise,
dbName: 'test-app'
})
}));
A MongoStore instance will emit the following events:
| Event name | Description | Payload |
|---|---|---|
create | A session has been created | sessionId |
touch | A session has been touched (but not modified) | sessionId |
update | A session has been updated | sessionId |
set | A session has been created OR updated (for compatibility purpose) | sessionId |
destroy | A session has been destroyed manually | sessionId |
When the session cookie has an expiration date, connect-mongo will use it.
Otherwise, it will create a new one, using ttl option.
app.use(session({
store: MongoStore.create({
mongoUrl: 'mongodb://localhost/test-app',
ttl: 14 * 24 * 60 * 60 // = 14 days. Default
})
}));
Note: Each time an user interacts with the server, its session expiration date is refreshed.
By default, connect-mongo uses MongoDB's TTL collection feature (2.2+) to have mongod automatically remove expired sessions. But you can change this behavior.
connect-mongo will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.
app.use(session({
store: MongoStore.craete({
mongoUrl: 'mongodb://localhost/test-app',
autoRemove: 'native' // Default
})
}));
Note: If you use connect-mongo in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!
In some cases you can't or don't want to create a TTL index, e.g. Azure Cosmos DB.
connect-mongo will take care of removing expired sessions, using defined interval.
app.use(session({
store: MongoStore.craete({
mongoUrl: 'mongodb://localhost/test-app',
autoRemove: 'interval',
autoRemoveInterval: 10 // In minutes. Default
})
}));
You are in production environnement and/or you manage the TTL index elsewhere.
app.use(session({
store: MongoStore.craete({
mongoUrl: 'mongodb://localhost/test-app',
autoRemove: 'disabled'
})
}));
If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refresh the page, you can lazy update the session, by limiting a period of time.
app.use(express.session({
secret: 'keyboard cat',
saveUninitialized: false, // don't create session until something stored
resave: false, //don't save session if unmodified
store: MongoStore.create({
mongoUrl: 'mongodb://localhost/test-app',
touchAfter: 24 * 3600 // time period in seconds
})
}));
by doing this, setting touchAfter: 24 * 3600 you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)
When working with sensitive session data it is recommended to use encryption
const store = MongoStore.create({
mongoUrl: 'mongodb://localhost/test-app',
crypto: {
secret: 'squirrel'
}
})
One of the following options should be provided. If more than one option are provided, each option will take precedence over others according to priority.
| Priority | Option | Description |
|---|---|---|
| 1 | mongoUrl | A connection string for creating a new MongoClient connection. If database name is not present in the connection string, database name should be provided using dbName option. |
| 2 | clientPromise | A Promise that is resolved with MongoClient connection. If the connection was established without database name being present in the connection string, database name should be provided using dbName option. |
| Option | Default | Description |
|---|---|---|
mongoOptions | { useUnifiedTopology: true } | Options object for MongoClient.connect() method. Can be used with mongoUrl option. |
dbName | A name of database used for storing sessions. Can be used with mongoUrl, or clientPromise options. Takes precedence over database name present in the connection string. | |
collectionName | 'sessions' | A name of collection used for storing sessions. |
ttl | 1209600 | The maximum lifetime (in seconds) of the session which will be used to set session.cookie.expires if it is not yet set. Default is 14 days. |
autoRemove | 'native' | Behavior for removing expired sessions. Possible values: 'native', 'interval' and 'disabled'. |
autoRemoveInterval | 10 | Interval (in minutes) used when autoRemove option is set to interval. |
touchAfter | 0 | Interval (in seconds) between session updates. |
stringify | true | If true, connect-mongo will serialize sessions using JSON.stringify before setting them, and deserialize them with JSON.parse when getting them. This is useful if you are using types that MongoDB doesn't support. |
serialize | Custom hook for serializing sessions to MongoDB. This is helpful if you need to modify the session before writing it out. | |
unserialize | Custom hook for unserializing sessions from MongoDB. This can be used in scenarios where you need to support different types of serializations (e.g., objects and JSON strings) or need to modify the session before using it in your app. | |
writeOperationOptions | Options object to pass to every MongoDB write operation call that supports it (e.g. update, remove). Useful for adjusting the write concern. Only exception: If autoRemove is set to 'interval', the write concern from the writeOperationOptions object will get overwritten. | |
transformId | Transform original sessionId in whatever you want to use as storage key. | |
crypto | Crypto related options. See below. |
| Option | Default | Description |
|---|---|---|
secret | false | Enables transparent crypto in accordance with OWASP session management recommendations. |
algorithm | 'aes-256-gcm' | Allows for changes to the default symmetric encryption cipher. See crypto.getCiphers() for supported algorithms. |
hashing | 'sha512' | May be used to change the default hashing algorithm. See crypto.getHashes() for supported hashing algorithms. |
encodeas | 'hex' | Specify to change the session data cipher text encoding. |
key_size | 32 | When using varying algorithms the key size may be used. Default value 32 is based on the AES blocksize. |
iv_size | 16 | This can be used to adjust the default IV size if a different algorithm requires a different size. |
at_size | 16 | When using newer AES modes such as the default GCM or CCM an authentication tag size can be defined. |
yarn install
docker-compose up -d
# Run these 2 lines in 2 shell
yarn watch:build
yarn watch:test
yarn link
cd example
yarn link "connect-mongo"
yarn install
yarn start
Since I cannot access the setting page. I can only do it manually.
CHANGELOG.md and README. Commit and push.yarn build && yarn test && npm publishgit tag vX.Y.Z && git push --tagsThe MIT License
FAQs
MongoDB session store for Express and Connect
We found that connect-mongo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
CISA launched a new project called Vulnrichment to enrich CVEs with details that help prioritize patching and mitigation efforts, as the NVD backlog of unenriched CVEs awaiting analysis surpasses 10,000.
Security News
Socket is joining forces with CISA and other industry leaders at the RSA Conference to sign the Secure by Design pledge, committing to uphold the highest security standards in our products.
Research
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.