Update Expiration Date at every request

[fstephany]

Is there a way to update the expiration date (of both the cookie and the server-managed session) at every request? Something along the line what is described there: https://stackoverflow.com/questions/35106336/sessions-should-a-session-cookie-be-refreshed-for-each-request

I like "By sending it every time, the app ensures that the session expires two hours after their last page hit.". But is this even desirable security-wise?

[maxcountryman]

It's technically possible to do this manually with set_expiration_time. You could automate this with a custom extractor, for example and then use it as a middleware. That said, we could also support this more directly through additional configuration options. From a security perspective, it's dependent on your use case.

[0rzech]

And that's what you've actually suggested in the code. 😉 If you're fine with the current approach, I will proceed with tests and making a PR.

[maxcountryman]

Sounds good. Happy to review a PR.

[0rzech]

For anyone interested: related option has been released with version 0.13.0.

[avsaase]

Hi, I found this discussion looking for a way to extend the session expiration when I don't change the session during requests. The option to save the session on every request solves the problem but requires writing to the session store on every page load. This also negates the performance benefit of the CachingSessionStore since you need to write to the database anyway.

A more lightweight approach would be to save a session if the current session expires within a given time frame. For example, with a one hour expiry and a 30 minute stale duration, the session would not be saved more often than every 30 minutes and still guarantee an active session for 30 minutes after the last activity.

For a simpler configuration it would be nice if you could set it to save the session if a given time since the last save has passed but Record doesn't contain the last update time so this is not directly possible.

Of course, the library user could implement this themselves by storing the necessary data within the session with a custom extractor (or layer?, I haven't tried this yet) but I think it would be nice if the library natively supported this. I have a branch that does this so I can make a PR if there's interest.

[avsaase]

In case anyone is interested, I created a gist with a middleware that updates the session expiration if a given period since the last update has passed.