65

I am newbie with the MEAN stack. I read the express-session github doc but there are some options which are unclear to me. Those options are saveUninitialized and resave.

Can anyone please explain with examples what are the advatanges of using saveUninitialized and resave, and what will the effect be if we change the boolean values in those options.

Syntax:-

app.use(session({
  resave: false,
  saveUninitialized: true,
}))
ericArbour
  • 439
  • 7
  • 11
user7104874
  • 981
  • 1
  • 11
  • 20

3 Answers3

161

Let's assume that sessions are enabled globally (for all requests).

When a client makes an HTTP request, and that request doesn't contain a session cookie, a new session will be created by express-session. Creating a new session does a few things:

  • generate a unique session id
  • store that session id in a session cookie (so subsequent requests made by the client can be identified)
  • create an empty session object, as req.session
  • depending on the value of saveUninitialized, at the end of the request, the session object will be stored in the session store (which is generally some sort of database)

If during the lifetime of the request the session object isn't modified then, at the end of the request and when saveUninitialized is false, the (still empty, because unmodified) session object will not be stored in the session store.

The reasoning behind this is that this will prevent a lot of empty session objects being stored in the session store. Since there's nothing useful to store, the session is "forgotten" at the end of the request.

When do you want to enable this? When you want to be able to identify recurring visitors, for example. You'd be able to recognize such a visitor because they send the session cookie containing the unique id.

About resave: this may have to be enabled for session stores that don't support the "touch" command. What this does is tell the session store that a particular session is still active, which is necessary because some stores will delete idle (unused) sessions after some time.

If a session store driver doesn't implement the touch command, then you should enable resave so that even when a session wasn't changed during a request, it is still updated in the store (thereby marking it active).

So it entirely depends on the session store that you're using if you need to enable this option or not.

robertklep
  • 174,329
  • 29
  • 336
  • 330
31

One thing to note is that if you set saveUninitialized to false, the session cookie will not be set on the browser unless the session is modified. That behavior may be implied but it was not clear to me when I was first reading through the documentation.

spencer.sm
  • 14,681
  • 8
  • 67
  • 76
  • 7
    Wow this seems to have helped me. Thanks. I was making a post request for a like button and I was saving a the req.sessionID to the DB. Anyways whenever I clicked the button I got a new req.SessionID. It was a scary hour. anyways. when I did the handler for post request I added `req.session.liked = id` and now I am not getting new session ids. Hopefully this fixed my problem. – jack blank Jun 11 '18 at 01:59
  • But what if the 'saveUninitialized' is set to "TRUE' but the session is not modified. I understand that the session will be saved in the store, but does a session cookie get set? – Neel Patel Feb 18 '21 at 06:55
0

on saveUninitialized set true server will provide the browser with session cookie as well as save it in its memory, even there is no modification you have done in the session object. but when the later field is set false server will provide the session cookie only when you modify the session object, if you already have the session cookie then no worries!!

Anirudh Sharma
  • 1