rack/rack — Issue #268: Setting expires_after in session options causes sessions to always be persisted
Author: bohlander
Created: 2011-11-17 23:53:55+00:00
State: open

It seems wrong that if expire_after is set this always causes sessions to be set. Here's the relevant code from Rack::Session::Abstract::ID

```
def force_options?(options)
options.values_at(:renew, :drop, :defer, :expire_after).any?
end

def commit_session?(env, session, options)
(loaded_session?(session) || force_options?(options)) && secure_session?(env, options)
end

```

In my scenario, I have :expires_after set because I want sessions to expire after a certain amount of time. But right now, setting this means that **every single request** will cause a session to be written, even if nothing was changed. This is really bad if you are using memcache sessions, and have REST API callers that don't send session keys.