touch() function is re-setting expire date

[woistjadefox]

Hi there

I just figured out that each time my users reload the page, that the expiry value in the SQLite database gets renewed.
Following your interface, it is the touch function causing a set() call doing this.

Is there a way where I can prevent this behavior? There is the rolling parameter for express-session, which is doing the same with the cookie on the client-side. Maybe makes sense to listen to this or add an extra parameter?

Thanks

[theogravity]

That's generally standard behavior. Why would you want to have a non-sliding expiration?

An option can def be added to not have it do it. I'm open to a PR if you want to add an option for this.

Call it disableExpiryRefresh.

[woistjadefox]

Hi @theogravity
Sorry, I was not aware that this is the standard behavior.
I think the issue with that is: when the session cookie expires (rolling=false), the session-id is still in the store/db and valid, if I'm not mistaken? So if a person should know the cookie value, it could still hijack the session even after the cookie expired with a crafted http/s request?

I will give a try to implement the disableExpiryRefresh if my statement above should be correct.

[theogravity]

I haven't used my lib for years that I don't remember the behavior at this point.

I also use JWTs now for managing sessions and haven't touched cookies for auth for years.

In JWT land, the access token would generally expire after an hour, while one would use the refresh token to get a new one.

The refresh token may have a rolling expiration window, or a fixed expiration (as in you're forced to log in again once your refresh token reaches x days).

The refresh and access / id tokens are stored in local storage instead of cookies.

Cookies may have a fixed or rolling exp (prob rolling in many cases so the user never have to log in as long as they use the site frequently is more common; or, fixed with a long exp like 60 or 90 days).

[theogravity]

Oh and I just noticed you mentioned the rolling option. If this lib isn't using it, please def fix that with that option instead of the flag i mentioned.

[theogravity]

I noticed I have this call:

https://github.com/theogravity/express-session-sqlite/blob/master/src/SqliteStoreBase.ts#L182C9-L182C30

You might need to clean up the stale entries by calling it is my guess here. They should be expired entries even if you see them in the db still.