{"action":"opened","issue":{"url":"https://api.github.com/repos/expressjs/session/issues/391","repository_url":"https://api.github.com/repos/expressjs/session","labels_url":"https://api.github.com/repos/expressjs/session/issues/391/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/session/issues/391/comments","events_url":"https://api.github.com/repos/expressjs/session/issues/391/events","html_url":"https://github.com/expressjs/session/issues/391","id":191934329,"number":391,"title":"Using .rolling = true but MaxAge is not always updated by requests","user":{"login":"danielflippance","id":5957235,"avatar_url":"https://avatars.githubusercontent.com/u/5957235?v=3","gravatar_id":"","url":"https://api.github.com/users/danielflippance","html_url":"https://github.com/danielflippance","followers_url":"https://api.github.com/users/danielflippance/followers","following_url":"https://api.github.com/users/danielflippance/following{/other_user}","gists_url":"https://api.github.com/users/danielflippance/gists{/gist_id}","starred_url":"https://api.github.com/users/danielflippance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielflippance/subscriptions","organizations_url":"https://api.github.com/users/danielflippance/orgs","repos_url":"https://api.github.com/users/danielflippance/repos","events_url":"https://api.github.com/users/danielflippance/events{/privacy}","received_events_url":"https://api.github.com/users/danielflippance/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-28T07:13:21Z","updated_at":"2016-11-28T07:13:21Z","closed_at":null,"body":"I've seen lots of questions about this, but none of the answers has solved my issue. I'm using express-session and I want the users session to remain alive as long as the user makes a request before the coookie MaxAge expires, hence I'm using the rolling option. For testing I have the MaxAge expiration set to 30 seconds.\r\n\r\nIf I browse around with only a couple of seconds between clicks, the session appears to stay alive. If however I make a request then wait 20 seconds, the session expires and I get logged out even though I was well within the 30 seconds.\r\n\r\nHere's how I have express-session configured:\r\n\r\n    var express = require('express')\r\n    , cookieParser = require('cookie-parser')\r\n    , session = require('express-session');\r\n\r\n    var app = express();\r\n    app.use(cookieParser(EXPRESS_SECRET));\r\n    app.use(\r\n        session({\r\n            cookie: { maxAge : 30000 },     //in milliseconds. 30 seconds for testing\r\n            resave: false,                  //Don't save the session to store if it hasn't changed\r\n            rolling: true,                  //Reset the cookie Max-Age on every request\r\n            saveUninitialized: false,       //Don't create a session for anonymous users\r\n            secret: EXPRESS_SECRET,\r\n            store: new MongoStore({ mongooseConnection: mongooseConnection })\r\n        })\r\n    );\r\n\r\nMy expectation is that setting rolling to true should allow me to continually remain logged in as long as I click at least once in less than every MaxAge.\r\n\r\nIs there something else I have to do to get this working?\r\n\r\n- This post suggested setting resave to true but it didn't change my results. http://stackoverflow.com/questions/36352179/express-session-rolling-session-expiry-configuration\r\n- This post suggested setting httpOnly to false, but no change for me http://stackoverflow.com/questions/14464873/expressjs-session-expiring-despite-activity/24794410#24794410\r\n- I've tried with secure both set to true and not set, with the same results (My site is https)\r\n- I've tried setting saveUninitialized to both true and false, with the same results.\r\n- express: 4.12.1\r\n- express-session: 1.10.3\r\n- cookie-parser: 1.3.5\r\n\r\nUpdate:\r\n\r\nSo strange, I've been hitting the same page every 15 seconds and monitoring the connect.sid cookie in the Chrome browser tools, and it usually is reset by 30 seconds on every request but every now and then, it doesn't change when I make a request. Sure enough waiting another 15 seconds and the session expires and I'm logged out."}}
{"actor":{"display_login":"danielflippance"}}