Skip to content

fix: prevent resaving already-saved regenerated session at end of request - #1155

Open
abdul-karim-mia wants to merge 1 commit into
expressjs:masterfrom
abdul-karim-mia:fix/regenerate-resave-race
Open

abdul-karim-mia wants to merge 1 commit into
expressjs:masterfrom
abdul-karim-mia:fix/regenerate-resave-race

Conversation

@abdul-karim-mia

Copy link
Copy Markdown

When req.session.regenerate() is called prior to req.session.save(), express-session was still resaving the session to the store when the response finished.

Cause

  1. wrapmethods only wrapped reload and save. When sess.regenerate replaced req.session with a newly generated session instance, the new instance did not have save or reload wrapped, so calling req.session.save() did not update savedHash.
  2. Additionally, originalId retained the old session ID from before regeneration. Because originalId !== sess.id, isSaved(sess) evaluated to false, causing shouldSave(req) to trigger a duplicate save at the end of the request.

Solution

  • Wrap sess.regenerate in wrapmethods using rewrapmethods.
  • In rewrapmethods, update originalId and originalHash to match the newly generated session, and reset savedHash if the session ID changed.
  • Added regression tests for saving regenerated sessions (both default and saveUninitialized: false).

Fixes #935

…uest

Signed-off-by: Abdul karim mia <97598943+abdul-karim-mia@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Regenerated session is re-saved even if not modified since save

1 participant