Search code examples
nestjscookie-session

cookie-session: req.session is null but cookies are not removed from browser

According to cookie-session docs Destroying a session can be done with req.session = null

In my Nestjs application I get the session (using the session decorator) and assign a userId property to it.

  @Post('/signin')
  @Serialize(UserDto)
  async signin(@Body() body: SigninUserDto, @Session() session: any) {
    const user = await this.authService.signin(body);
    session.userId = user.id;
    return user;
  }

This creates a session in the browser: enter image description here

On signout, I set the session to null, as per the documentation, and in the browser, the session cookie is still visible. Why is it not removed; does this present a security concern; and how does one remove the session if it is a security concern?

  @Post('/signout')
  @UseGuards(AuthGuard)
  @Serialize(UserDto)
  signout(@Session() session: any) {
    session = null;
  }

Edit: Some additional info - On the frontend I created a basic login form using NextJS that redirects the user to a home page with a simple logout button. the logout button sends an api call to the signout endpoint in my NestJS application that assigns session=null.

Solution

  • Did you inspect cookie contents? Probably session = null removes some session-data from cookie and leaves just a blank cookie

    If not:

    You could try to use @Req() req: Request and then call req.session = null