Search code examples
node.jssessionsession-cookiessession-variables

default values of resave and saveUninitialised options for node sessions

I have a node application, where in my app.js file I have the following code snippet:

  app.use(session({ 
    secret: 'secretpassword',
    cookie: {
      maxAge: 47234723847823
    },
  }));

When I try to run the application, I get the following lines in debug console:

Fri, 10 Jul 2020 11:23:18 GMT express-session deprecated undefined resave option; provide resave option at app.js:64:11
Fri, 10 Jul 2020 11:23:18 GMT express-session deprecated undefined saveUninitialized option; provide saveUninitialized option at app.js:64:11

I understand from sources that I need to explicitly add values for resave and saveUninitialised in the code snippet I had earlier, but from what I understand the default values for both were true and my application was working fine before.

So my question is can I just set both values to true and expect the app to work the same as it did before? I'm not sure if the default values my app was using previously changed during the deprecation, and testing the app with both true and false has led to no observable differences.

Solution

  • TL;DR Yes, you can/should do that.

    The README says for both of those values:

    The default value is true, but using the default has been deprecated, as the default will change in the future. Please research into this setting and choose what is appropriate to your use-case.

    Since they intend to change the default value, they added a warning so that users can consider and explicitly set what behavior they want to avoid surprises later.