$ npm install connect-mongo
MongoDB session store for Connect and Express
5.0
>= 5.0
>= 3.0
>= 3.2
For extended compatibility, see previous versions. This branch is under development. Documentation for latest release please refer to v2.0.3
Express 4.x
, 5.0
and Connect 3.x
:
const session = require('express-session');
const MongoStore = require('connect-mongo')(session);
app.use(session({
secret: 'foo',
store: new MongoStore(options)
}));
Express 2.x
, 3.x
and Connect 1.x
, 2.x
:
const MongoStore = require('connect-mongo')(express);
app.use(express.session({
secret: 'foo',
store: new MongoStore(options)
}));
For Connect 1.x
and 2.x
, just replace express
by connect
.
In many circumstances, connect-mongo
will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.
Alternatively, you can configure connect-mongo
to establish a new connection.
const mongoose = require('mongoose');
// Basic usage
mongoose.connect(connectionOptions);
app.use(session({
store: new MongoStore({ mongooseConnection: mongoose.connection })
}));
// Advanced usage
const connection = mongoose.createConnection(connectionOptions);
app.use(session({
store: new MongoStore({ mongooseConnection: connection })
}));
In this case, you just have to give your MongoClient
instance to connect-mongo
.
/*
** There are many ways to create MongoClient.
** You should refer to the driver documentation.
*/
app.use(session({
store: new MongoStore({ client: clientInstance })
}));
Or just give a promise...
app.use(session({
store: new MongoStore({ clientPromise: clientInstancePromise })
}));
MongoDB connection strings are the best way to configure a new connection. For advanced usage, more options can be configured with mongoOptions
property.
// Basic usage
app.use(session({
store: new MongoStore({ url: 'mongodb://localhost/test-app' })
}));
// Advanced usage
app.use(session({
store: new MongoStore({
url: 'mongodb://user12345:foobar@localhost/test-app?authSource=admins&w=1',
mongoOptions: advancedOptions // See below for details
})
}));
A MongoStore
instance will emit the following events:
Event name | Description | Payload |
---|---|---|
create |
A session has been created | sessionId |
touch |
A session has been touched (but not modified) | sessionId |
update |
A session has been updated | sessionId |
set |
A session has been created OR updated (for compatibility purpose) | sessionId |
destroy |
A session has been destroyed | sessionId |
When the session cookie has an expiration date, connect-mongo
will use it.
Otherwise, it will create a new one, using ttl
option.
app.use(session({
store: new MongoStore({
url: 'mongodb://localhost/test-app',
ttl: 14 * 24 * 60 * 60 // = 14 days. Default
})
}));
Note: Each time an user interacts with the server, its session expiration date is refreshed.
By default, connect-mongo
uses MongoDB's TTL collection feature (2.2+) to have mongod automatically remove expired sessions. But you can change this behavior.
connect-mongo
will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.
app.use(session({
store: new MongoStore({
url: 'mongodb://localhost/test-app',
autoRemove: 'native' // Default
})
}));
Note: If you use connect-mongo
in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!
You have an older MongoDB version (compatible with connect-mongo) or you can't or don't want to create a TTL index.
connect-mongo
will take care of removing expired sessions, using defined interval.
app.use(session({
store: new MongoStore({
url: 'mongodb://localhost/test-app',
autoRemove: 'interval',
autoRemoveInterval: 10 // In minutes. Default
})
}));
You are in production environnement and/or you manage the TTL index elsewhere.
app.use(session({
store: new MongoStore({
url: 'mongodb://localhost/test-app',
autoRemove: 'disabled'
})
}));
If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refresh the page, you can lazy update the session, by limiting a period of time.
app.use(express.session({
secret: 'keyboard cat',
saveUninitialized: false, // don't create session until something stored
resave: false, //don't save session if unmodified
store: new MongoStore({
url: 'mongodb://localhost/test-app',
touchAfter: 24 * 3600 // time period in seconds
})
}));
by doing this, setting touchAfter: 24 * 3600
you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)
When working with sensitive session data it is recommended to use encryption
const store = new MongoStore({
url: 'mongodb://localhost/test-app',
secret: 'squirrel'
})
collection
Collection (default: sessions
)fallbackMemory
Fallback to MemoryStore
. Useful if you want to use MemoryStore in some case, like in development environment.stringify
If true, connect-mongo will serialize sessions using JSON.stringify
before
setting them, and deserialize them with JSON.parse
when getting them.
(optional, default: true). This is useful if you are using types that
MongoDB doesn't support.serialize
Custom hook for serializing sessions to MongoDB. This is helpful if you need
to modify the session before writing it out.unserialize
Custom hook for unserializing sessions from MongoDB. This can be used in
scenarios where you need to support different types of serializations
(e.g., objects and JSON strings) or need to modify the session before using
it in your app.writeOperationOptions
Options object to pass to every MongoDB write operation call that
supports it (e.g. update
, remove
). Useful for adjusting the write concern.
Only exception: If autoRemove
is set to 'interval'
, the write concern
from the writeOperationOptions
object will get overwritten.transformId
(optional) Transform original sessionId in whatever you want to use as storage key.secret
(optional) Enables transparent crypto in accordance with OWASP session management recommendations.algorithm
(optional) Allows for changes to the default symmetric encryption cipher; default is GCM
. See crypto.getCiphers()
for supported algorithms.hashing
(optional) May be used to change the default hashing algorithm; default is sha512
. See crypto.getHashes()
for supported hashing algorithms.encodeas
(optional) Specify to change the session data cipher text encoding. Default is hex
.key_size
(optional) When using varying algorithms the key size may be used. Default is 32
based on the AES
blocksize.iv_size
(optional) This can be used to adjust the default IV size if a different algorithm requires a different size. Default is 16
.at_size
(optional) When using newer AES
modes such as the default GCM
or CCM
an authentication tag size can be defined; default is 16
.npm test
The tests use a database called connect-mongo-test
.
Open source projects and production apps using connect-mongo
. Feel free to add yours in a pull request.
The MIT License
© 2010 - cnpmjs.org x YWFE | Home | YWFE