@fastify/session v10.0.0 or What is missing for the next version?

[Uzlopak]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the issue has not already been raised

Issue

Alot of work has been invested into this plugin. But are we now feature complete? I have the feeling that we are so close to have it the biggest issues fixed.

On one hand I am kind of exhausted by the work on this plugin. So basically I read the unit tests, and dont understand them anymore. And on the other hand, I really want that we get a release soon.

So can we please consolidate the open issues in this thread? Or open new issues.

It would be good if you would read critically the code too. Maybe you see something we did overlook? Or is maybe totally wrong in the first place?

So give please feedback.

So I start, and if I find more cases or if you find some then please post them. I would add them to this list.

[ ] check if rolling is working as expected

[Uzlopak]

pinging people, who are maybe willing to give feedback:
@rclmenezes
@SimenB
@cameronmbell
@sarneeh
@m0dch3n

[rclmenezes]

On one hand I am kind of exhausted by the work on this plugin. So basically I read the unit tests, and dont understand them anymore. And on the other hand, I really want that we get a release soon.

Totally agree! Honestly, I've been following this repo and it's been much cleaner to work with:
https://github.com/mgcrea/fastify-session

I also experimented with importing Store and Session from express-session and plugging it in via fastify hooks. That way, we can make a separate repo for users who want express compatibility and we can stop worrying about replicating express-session's behavior here.

Anyway, I'm off-topic. The other things I think we should do:

• We should save maxAge as originalMaxAge in session.cookie. This would allow services using express-session and services using @fastify/session to use same session store. It's important to me personally (at work I'm trying to migrate us off Express), so I'll work on this next.
• We should probably try making rolling work as expected. I don't think the option does anything anymore!
• Make sure saveUninitialized + maxAge work as expected
• cookie.maxAge should have priority over cookie.expires. In our code here, we don't do that even though our docs say otherwise. I haven't made an issue yet because I haven't had time to think through if there's a bug here, but it smells suspicious.
• Minor refactor -- we can rm maxAge as a key here since we can use session.cookieOpts.maxAge instead.

[rclmenezes]

Also -- thank you @Uzlopak for all your work so far!

[SimenB]

#134 and #143 are the main breaking things I was waiting on, very happy to see them land 😀 Beyond that I don't really know what's missing (@rclmenezes's list looks good). As mentioned in #101 (comment) we had issues with the data persisted in the session, but I still haven't found the time to dig into it. And regardless, I doubt the fix will be semver major (it might even have gotten fixed along the way if we're lucky 🙂)

[climba03003]

I would like to know how many task are left?
If there are no pending task or new comment, I will release a new major on this Friday 9 / 9.

Then, I will cut a next branch to prevent staling lots of breaking changes in master.

[SimenB]

Probably just missing #154?

[Uzlopak]

It seems Feature complete. But i would prefer not to release now. I want to just do final check. So i think friday is a good finish Line

[Eomm]

Are we ready to land?

[Uzlopak]

Please wait. I have found three small issues. PR are incoming

[Uzlopak]

I provided all three PRs.

#168
#169
#170

After that I will not touch this plugin for a while :D

[mcollina]

@Uzlopak could you sum up in a paragraph all the changes you did for this release? A long list of PRs might be hard to digest.

[Uzlopak]

Based on the auto generated release notes I modified them. I thought you maybe want to copy paste that.

---

Relevant Changes

• express-session compatibility: Add cookiePrefix as an option to allow for compatibility with express-session by @rclmenezes in Add cookiePrefix as an option to allow for compatibility with express-session #113
• express-session compatibility: Move expires from session to session.cookies by @rclmenezes in Move expires from session to session.cookies #120
• feat: use @fastify/cookie-signer-logic for signing and unsigning by @Uzlopak in feat: use @fastify/cookie-signer-logic for signing and unsigning #129
• express-session compatibility: prevent sessionId from being stored in the sessionStore by @rclmenezes in Remove session id round 4 #134
• express-session compatibility: prevent encryptedSessionId from being stored in the sessionStore by @Uzlopak in prevent encryptedSessionId from being stored in the sessionStore #143
• bugfix: Resave session cookie if saveUninitialized is false and rolling is true by @rclmenezes in Resave session cookie if saveUninitialized is false and rolling is true #149
• bugfix: use maxAge over expires by @Uzlopak in use maxAge over expires #152
• bugfix: Make it possible to call save() in decryptSession by @Uzlopak in Make it possible to call save() in decryptSession #161
• express-session compatibility: Implement originalMaxAge by @rclmenezes in Implement originalMaxAge #162
• Remove deprecation notice for fastify-Instance decryptSession by @shrihari-prakash in Remove deprecation notice for fastify-Instance decryptSession #164
• typings: add typings for decryptSession by @Uzlopak in add typings for decryptSession #165
• security: verify path of cookie/session by @Uzlopak in security: verify path of cookie/session #169

What also Changed

• feat: Update benchmark. by @ShogunPanda in feat: Update benchmark. #91
• ci: migrate to fastify reusable workflow by @Fdawgs in ci: migrate to fastify reusable workflow #90
• build(deps-dev): bump fastify-cookie from 5.6.1 to 5.7.0 by @dependabot in build(deps-dev): bump fastify-cookie from 5.6.1 to 5.7.0 #92
• docs(readme): remove snyk badge by @Fdawgs in docs(readme): remove snyk badge #93
• chore(.gitignore): use updated skeleton template by @Fdawgs in chore(.gitignore): use updated skeleton template #96
• build(deps-dev): bump @types/node from 17.0.45 to 18.0.0 by @dependabot in build(deps-dev): bump @types/node from 17.0.45 to 18.0.0 #97
• build(deps-dev): bump tsd from 0.20.0 to 0.21.0 by @dependabot in build(deps-dev): bump tsd from 0.20.0 to 0.21.0 #98
• build(deps-dev): bump tsd from 0.21.0 to 0.22.0 by @dependabot in build(deps-dev): bump tsd from 0.21.0 to 0.22.0 #102
• style(types/types.test-d.ts): explicitly declare semicolon by @Fdawgs in style(types/types.test-d.ts): explicitly declare semicolon #103
• refactor: use optional chaining by @Fdawgs in refactor: use optional chaining #104
• build(deps): bump fastify-plugin from 3.0.1 to 4.0.0 by @dependabot in build(deps): bump fastify-plugin from 3.0.1 to 4.0.0 #105
• remove metadata.js by @Uzlopak in remove metadata.js #107
• separate lint from npm test script, activate lint and license-check in ci pipeline by @Uzlopak in separate lint from npm test script, activate lint and license-check in ci pipeline #108
• refactor unit tests, replace ava with tap, remove undici and typescript as devDependencies by @Uzlopak in refactor unit tests, replace ava with tap, remove undici and typescript as devDependencies #109
• move benchmark to corresponding folder, slim it down by @Uzlopak in move benchmark to corresponding folder, slim it down #110
• tap should only run test.js files by @Uzlopak in tap should only run test.js files #115
• Clean up tests by @rclmenezes in Clean up tests #117
• Add missing documentation for README.md by @rclmenezes in Add missing documentation for README.md #116
• Simplify shouldSaveSession code a little bit by @rclmenezes in Simplify shouldSaveSession code a little bit #119
• simplify callback typing by @Uzlopak in simplify callback typing #124
• perf: improve idgenerator (about 25-30 % faster) by @Uzlopak in perf: improve idgenerator (about 25-30 % faster) #123
• chore: remove addDataToSession by @Uzlopak in chore: remove addDataToSession #127
• add autocannon example by @Uzlopak in add autocannon example #128
• move signer require into ensureDefaults by @Uzlopak in move signer require into ensureDefaults #130
• fix unit test by @Uzlopak in fix unit test #132
• fix lgtm alert by @Uzlopak in fix lgtm alert #133
• simplify getExpires, export getExpires from cookie by @Uzlopak in simplify getExpires, export getExpires from cookie #135
• remove internal used session restore() function by @Uzlopak in remove internal used session restore() function #136
• remove sinon as dev dependency by @Uzlopak in remove sinon as dev dependency #139
• add redis example by @Uzlopak in add redis example #142
• add pre-commit by @Uzlopak in add pre-commit #145
• add unit test for maxAge by @Uzlopak in add unit test for maxAge #144
• create a separate unit test file for memorystore by @Uzlopak in create a separate unit test file for memorystore #150
• rename secret.test.js to fastifySession.checkOptions.test.js and refactor it by @Uzlopak in rename secret.test.js to fastifySession.checkOptions.test.js and refactor it #151
• build(deps-dev): bump tsd from 0.22.0 to 0.23.0 by @dependabot in build(deps-dev): bump tsd from 0.22.0 to 0.23.0 #153
• rename session to fastifySession by @Uzlopak in rename session to fastifySession #160
• simplify cookie handling by @Uzlopak in simplify cookie handling #166
• ensure that secure false is not overwritten by null when stored in the sessionStore by @Uzlopak in ensure that secure false is not overwritten by null #168
• minor cosmetic change by @Uzlopak in minor cosmetic change #167

New Contributors

• @ShogunPanda made their first contribution in feat: Update benchmark. #91
• @Uzlopak made their first contribution in remove metadata.js #107
• @rclmenezes made their first contribution in Clean up tests #117
• @shrihari-prakash made their first contribution in Remove deprecation notice for fastify-Instance decryptSession #164

Full Changelog: v9.0.0...v10.0.0

[climba03003]

Released 16ef7eb

[climba03003]

I have added a Notable Changes section on the release notes.

@Uzlopak Can you helps me to check if anything missing.