Change cookie expiration in Express

Question

Because I didn't define a maxAge when calling expressServer.use(express.session({params})) the cookie's expiration is set as "Session".

I would like to add a "remember me" feature when logging in. If "remember me" is selected, the expiration will be extended to a month.

How would I go about doing this? I tried simply extending the maxAge, but that didn't seem to do anything...

expressServer.get '/blah', (request, response) =>
    request.session.cookie.maxAge = 2592000
    response.end 'hello there'

I tried making a simple server to test updating a user's cookie. I'm using Express 3.0.4

When I visit 127.0.0.1:9000/blah, the browser cookie's "expires" field is still "session"...

express = require 'express'

expressServer = express()
expressServer.use express.cookieParser()
expressServer.use express.session
    secret: 'supersecret'
    cookie:
        path: '/'
        httpOnly: true

expressServer.get '/', (request, response) =>
    response.end 'hello'

expressServer.get '/blah', (request, response) =>
    request.session.cookie.maxAge = 3600000
    response.end 'hello again'

expressServer.listen 9000
console.log 'server running'

However, if I clear my browser cookies and visit "/blah", the "expires" field is set correctly. Which makes sense, since the cookie needs to be set for the first time :) — user1161657, Dec 27 '12 at 07:47
Ok... it seems to work ONLY if I update the session... So I just added `request.session.blah = Date()` and things magically work? — user1161657, Dec 27 '12 at 08:05
You could try to [set the maxAge with a default value](http://www.senchalabs.org/connect/middleware-session.html) and then expire the cookie if the checkbox is not checked (req.session.cookie.expires = false). — Frank, Dec 27 '12 at 11:59

chovy · Answer 1 · 2012-12-27T07:25:05.963

I have a checkbox that says "remember me" on the /login page:

<p class="remember">
  <input type="checkbox" id="remember" name="remember" value="1" />
  <label for="remember">Remember me</label>
</p>

Then in my POST route to /login I do some sanity checking and set the session if req.body.remember is set otherwise its just a window session:

  //user is authenticated
  //set session length
  if ( req.body.remember ) {
    var hour = 3600000;
    req.session.cookie.maxAge = 14 * 24 * hour; //2 weeks
  } else {
    req.session.cookie.expires = false;
  }

  req.session.userid = user._id;

Add the following few lines (I use redis) in app.js:

  app.use(express.cookieParser('secret-word'));
  app.use(express.session({
    store: new RedisStore({
      host: cfg.redis.host,
      db: cfg.redis.db
    }),
    secret: 'another-secret'
  }));

For me, it changes the session's cookie on the backend, but doesn't actually change anything in the browser :'( — user1161657, Dec 27 '12 at 05:40
I updated the answer. I'm using redis, this is all i had to do to get it to work. — chovy, Dec 27 '12 at 07:25

score 10 · Answer 2 · edited Jun 10 '16 at 11:18

10

Set cookie name to value, where which may be a string or object converted to JSON. The path option defaults to "/".

res.cookie('rememberme', '1', 
                { expires: new Date(Date.now() + 900000), httpOnly: true });

For further references following the link may be used

http://expressjs.com/api.html#res.cookie

edited Jun 10 '16 at 11:18

profesor79

9,213
3
31
52

answered Aug 21 '13 at 09:20

AmirtharajCVijay

1,078
11
12

borisdiakur · Answer 3 · 2017-11-10T08:11:42.760

If you want to implement rolling sessions with cookie-sessions in express 4, configure the middleware like this:

app.use(cookieSession({
    secret: your_secret,
    maxAge: your_maxAge,
    key: 'sessionId'
}));

Note that you do not need to set the expires option.

In order to extend your session, simply alter it like this:

app.get('*', function (req, res, next) {
    req.session.foobar = Date.now();
    next();
}

Note that in express 4 there is no req.session.touch().

score 2 · Answer 4 · edited May 23 '17 at 11:46

2

I found an answer that seems to work for me; add it to the top of your routes.

app.all '*', (req,res,next) ->
  if req.method is 'HEAD' or req.method is 'OPTIONS'  
    next()
  else
    req.session._garbage = Date();
    req.session.touch();
    next();

edited May 23 '17 at 11:46

Community

1
1

answered Aug 14 '13 at 11:11

Hitchcott

152
4

Bug reported to the link above – mercury Feb 12 '22 at 00:27

score 0 · Answer 5 · answered Nov 20 '17 at 16:10

0

Or You can try this, it worked for me:

if ( req.body.remember ) 
{
    var oneWeek = 7 * 24 * 3600 * 1000; //1 weeks                    
    req.session.cookie.expires = new Date(Date.now() + oneWeek);
    req.session.cookie.maxAge = oneWeek; 
}

answered Nov 20 '17 at 16:10

sumitjainjr

741
1
8
28

Change cookie expiration in Express

5 Answers5

Linked