kcbanner/connect-mongo — pull request #50 by aroman (2012-12-17 03:36:58+00:00)
Title: Use TTL sessions for removing expired sessions, set browser-session-length expiring cookies (maxAge: null) to expire after 2 weeks of inactivity

Based on the discussion in #46, I've replaced the previous implementation of using setInterval and a mongo query to remove expired sessions, and moved to using mongodb's native collection TTLs.

Please note, while these changes are not strictly "breaking", they do change some functionality (for the better!). Specifically:

- sessions with no specific expiry (which is the default -- maxAge defaults to null) are now set to expire after 2 weeks of inactivity. This seems to be the industry standard practice, and is the default in projects such as django. If there is a need, it would of course be possible to make this time configurable.

- clear_interval has been made obsolete (and thus removed). This now defaults to the server-side value of every 60 seconds

- collection TTLs only went stable in mongodb 2.2. So this will cause connect-mongo to **BREAK** on people using mongod < 2.2.x. If this is a deal-breaker for you (it isn't for my selfish needs), I would be happy to simply only set the TTL index if connected to a mongodb server running >= 2.2. (This would mean that, as before, browser-session-based sessions would stay in the database indefinitely, as well as prevent sessions with actual expirations from being removed. I guess we could fallback to your manual removal system, but I figured I wouldn't waste my time if nobody needs it.)

Additionally, the two tests that dealt with testing the "manual" TTL system have been removed, since that system is no longer being used.