Repository: expressjs/session

Issue #521: Sharing session store between multiple session instances doesn't work
Created: 2017-11-04T15:21:20Z
In my code I've two session instances with different cookie options (domain, path). Those two express-session instances share same RedisStore with different cookie options. However it does not seem to matter which express-session instance is used, the later instantiated cookie options will be applied.
To be concrete, I wrote test case to show what I expected the results would be, but currently this test case fails:
    it('should use own session opts with shared store', function(done){

      // The beef: sharing same store instance. Replace with null and the test will pass
      var store = new session.MemoryStore()

      var app = express()
          .use('/path1', createSession({store, cookie: { path: '/path1' }}))
          .use('/path2', createSession({store, cookie: { path: '/path2' }}))
          .use(function(req, res, next){
            res.end()
          })

      request(app)
        .get('/path2')
        .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/path2'))
        .expect(200, function (err, res) {
          if (err) return done(err)
          request(app)
            .get('/path1')
            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/path1'))
            .expect(200, done)
        })
    })

Should it work if one store is shared between multiple session/cookie options? Or is this just wrong usage?

Duplicate issue #613: Multiple session configurations getting wrong cookie path
Created: 2018-09-21T22:23:38Z
Hi,
I'm running multiple session configurations: one for /account and one for /admin.
I'm seeing an issue in my test environment where I'm getting the wrong cookie path back.
import session from 'express-session';
import redisSession from 'connect-redis';
import redisClient from '../';
import config from '../../../../config';

const secret = config(`server.${process.env.NODE_ENV}.sessionHash`);
const secureCookie = config(`server.${process.env.NODE_ENV}.secureCookie`);

const RedisStore = redisSession(session);

const redisSessionMiddleWare = (app, pathArray) => {
  const store = new RedisStore({
    client: redisClient,
    checkExpirationInterval: 15 * 60 * 1000,
    expiration: 24 * 90 * 60 * 60 * 1000
  });

  pathArray.forEach(path => {
    app.use(
      path,
      session({
        name: `connect.${path.slice(1)}.sid`,
        secret,
        store,
        saveUninitialized: false,
        resave: false, 
        proxy: true,
        maxAge: null,
        cookie: {
          path,
          expires: false,
          secure: secureCookie,
          httpOnly: true
        }
      })
    );
  });
};

export default redisSessionMiddleWare;

I call this function with array ['/account','/admin']
I use two passport instances to separate these two session configurations.
What I see coming back in a test where I login the user against the /account configuration
{ 'x-powered-by': 'Express',
      'content-type': 'application/json; charset=utf-8',
      'content-length': '121',
      etag: 'W/"79-D8DXGRyLafctjYYqUTCdTzPheS8"',
      'set-cookie': 
       [ 'connect.account.sid=s%3AewWpmjvMZq-sXEtOESxXJfvohrJT62q6.zb9Wpbi2orm9CJf3XyWdyhT28M5Uo2Q2hJ25ARacqOI; Path=/admin; HttpOnly' ],
      connection: 'close' }

Note that the Path = different from the session key. Per the code, I would expect the Path to be /account
That seems odd, given that this configuration should  setup the connect.account.sid together with the /account path. It seems like it takes the correct session name but the last cookie path in the array (/admin)
Is there any obvious way where the cookie path will not be what was passed in the configuration?

Closing comment (2018-09-22T23:31:14Z): It is a duplicate of #521