connect-mongoose-only v3.2.1

connect-mongoose-only

Mongoose session store for Connect and Express

Compatibility

• Support Express up to 5.0
• Support all Connect versions
• Support Mongoose >= 5.0
• Support Node.js 8, 10 and 12
• Support MongoDB 3.2 - 4.0

Usage

Express or Connect integration

Express 4.x, 5.0 and Connect 3.x:

const session = require('express-session');
const MongoStore = require('connect-mongoose-only')(session);

app.use(session({
    secret: 'foo',
    store: new MongoStore(options)
}));

Connection to MongoDB

In many circumstances, connect-mongoose-only will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.

Alternatively, you can configure connect-mongoose-only to establish a new connection.

Re-use an existing Mongoose connection

const mongoose = require('mongoose');

// Basic usage
mongoose.connect(connectionOptions);

app.use(session({
    store: new MongoStore({ mongooseConnection: mongoose.connection })
}));

// Advanced usage
const connection = mongoose.createConnection(connectionOptions);

app.use(session({
    store: new MongoStore({ mongooseConnection: connection })
}));

Create a new connection from a MongoDB connection string

MongoDB connection strings are the best way to configure a new connection. For advanced usage, more options can be configured with mongoOptions property.

// Basic usage
app.use(session({
    store: new MongoStore({ url: 'mongodb://localhost/test-app' })
}));

// Advanced usage
app.use(session({
    store: new MongoStore({
        url: 'mongodb://user12345:foobar@localhost/test-app?authSource=admins&w=1',
        mongoOptions: advancedOptions // See below for details
    })
}));

Events

A MongoStore instance will emit the following events:

Session expiration

When the session cookie has an expiration date, connect-mongoose-only will use it.

Otherwise, it will create a new one, using ttl option.

app.use(session({
    store: new MongoStore({
        url: 'mongodb://localhost/test-app',
        ttl: 14 * 24 * 60 * 60 // = 14 days. Default
    })
}));

Note: Each time an user interacts with the server, its session expiration date is refreshed.

Remove expired sessions

By default, connect-mongoose-only uses MongoDB's TTL collection feature (2.2+) to have mongod automatically remove expired sessions. But you can change this behavior.

Set MongoDB to clean expired sessions (default mode)

connect-mongoose-only will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.

app.use(session({
    store: new MongoStore({
        url: 'mongodb://localhost/test-app',
        autoRemove: 'native' // Default
    })
}));

Note: If you use connect-mongoose-only in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!

Set the compatibility mode

You have an older MongoDB version (compatible with connect-mongoose-only) or you can't or don't want to create a TTL index.

connect-mongoose-only will take care of removing expired sessions, using defined interval.

app.use(session({
    store: new MongoStore({
      url: 'mongodb://localhost/test-app',
      autoRemove: 'interval',
      autoRemoveInterval: 10 // In minutes. Default
    })
}));

Disable expired sessions cleaning

You are in production environnement and/or you manage the TTL index elsewhere.

app.use(session({
    store: new MongoStore({
        url: 'mongodb://localhost/test-app',
        autoRemove: 'disabled'
    })
}));

Lazy session update

If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refresh the page, you can lazy update the session, by limiting a period of time.

app.use(express.session({
    secret: 'keyboard cat',
    saveUninitialized: false, // don't create session until something stored
    resave: false, //don't save session if unmodified
    store: new MongoStore({
        url: 'mongodb://localhost/test-app',
        touchAfter: 24 * 3600 // time period in seconds
    })
}));

by doing this, setting touchAfter: 24 * 3600 you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)

Transparent encryption/decryption of session data

When working with sensitive session data it is recommended to use encryption

const store = new MongoStore({
    url: 'mongodb://localhost/test-app',
    secret: 'squirrel'
})

Options

Connection-related options (required)

One of the following options should be provided. If more than one option are provided, each option will take precedence over others according to priority.

More options

Crypto-related options

Tests

docker run --rm -p 27017:27017 mongo:3.6
yarn install
yarn test

The tests use a database called connect-mongoose-only-test.

Showcase

Open source projects and production apps using connect-mongoose-only. Feel free to add yours in a pull request.

• Builder Book: Open source web app to write and host documentation or sell books. Built with React, Material-UI, Next, Express, Mongoose, MongoDB.

License

The MIT License