connect-mongo

MongoDB session store for Connect and Express written in Typescript.

Breaking change in V4 and rewritten the whole project using Typescript. Please checkout the migration guide and changelog for details.

• Install
• Compatibility
• Usage
  • Express or Connect integration
  • Connection to MongoDB
• Known issues
  • Native autoRemove causing error on close
  • MongoError exports circular dependency
  • Existing encrypted v3.2.0 sessions are not decrypted correctly by v4
• Events
• Session expiration
• Remove expired sessions
  • Set MongoDB to clean expired sessions (default mode)
  • Set the compatibility mode
  • Disable expired sessions cleaning
• Lazy session update
• Transparent encryption/decryption of session data
• Options
  • Connection-related options (required)
  • More options
  • Crypto-related options
• Development
  • Example application
  • Release
• License

Install

npm install connect-mongo
yarn add connect-mongo

• You may also need to run install mongodb if you do not have it installed already because mongodb is not a peerDependencies instead.
• If you are upgrading from v3.x to v4, please checkout the migration guide for details.
• If you are upgrading v4.x to latest version, you may check the example and options for details.

Compatibility

• Support Express up to 5.0
• Support native MongoDB driver >= 5.0
• Support Node.js 14, 16 and 18
• Support MongoDB 3.6+

For extended compatibility, see previous versions v3.x. But please note that we are not maintaining v3.x anymore.

Usage

Express or Connect integration

Express 4.x, 5.0 and Connect 3.x:

const session = require('express-session');
const MongoStore = require('connect-mongo');

app.use(session({
  secret: 'foo',
  store: MongoStore.create(options)
}));

import session from 'express-session'
import MongoStore from 'connect-mongo'

app.use(session({
  secret: 'foo',
  store: MongoStore.create(options)
}));

Connection to MongoDB

In many circumstances, connect-mongo will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.

Alternatively, you can configure connect-mongo to establish a new connection.

Create a new connection from a MongoDB connection string

MongoDB connection strings are the best way to configure a new connection. For advanced usage, more options can be configured with mongoOptions property.

// Basic usage
app.use(session({
  store: MongoStore.create({ mongoUrl: 'mongodb://localhost/test-app' })
}));

// Advanced usage
app.use(session({
  store: MongoStore.create({
    mongoUrl: 'mongodb://user12345:foobar@localhost/test-app?authSource=admin&w=1',
    mongoOptions: advancedOptions // See below for details
  })
}));

Re-use an existing native MongoDB driver client promise

In this case, you just have to give your MongoClient instance to connect-mongo.

/*
** There are many ways to create MongoClient.
** You should refer to the driver documentation.
*/

// Database name present in the connection string will be used
app.use(session({
  store: MongoStore.create({ clientPromise })
}));

// Explicitly specifying database name
app.use(session({
  store: MongoStore.create({
    clientPromise,
    dbName: 'test-app'
  })
}));

Known issues

Known issues in GitHub Issues page.

Native autoRemove causing error on close

• Calling close() immediately after creating the session store may cause error when the async index creation is in process when autoRemove: 'native'. You may want to manually manage the autoRemove index. #413

MongoError exports circular dependency

The following error can be safely ignored from official reply.

(node:16580) Warning: Accessing non-existent property 'MongoError' of module exports inside circular dependency
(Use `node --trace-warnings ...` to show where the warning was created)

Existing encrypted v3.2.0 sessions are not decrypted correctly by v4

v4 cannot decrypt the session encrypted from v3.2 due to a bug. Please take a look on this issue for possible workaround. #420

Events

A MongoStore instance will emit the following events:

Session expiration

When the session cookie has an expiration date, connect-mongo will use it.

Otherwise, it will create a new one, using ttl option.

app.use(session({
  store: MongoStore.create({
    mongoUrl: 'mongodb://localhost/test-app',
    ttl: 14 * 24 * 60 * 60 // = 14 days. Default
  })
}));

Note: Each time a user interacts with the server, its session expiration date is refreshed.

Remove expired sessions

By default, connect-mongo uses MongoDB's TTL collection feature (2.2+) to have mongodb automatically remove expired sessions. But you can change this behavior.

Set MongoDB to clean expired sessions (default mode)

connect-mongo will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.

app.use(session({
  store: MongoStore.create({
    mongoUrl: 'mongodb://localhost/test-app',
    autoRemove: 'native' // Default
  })
}));

Note: If you use connect-mongo in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!

Set the compatibility mode

In some cases you can't or don't want to create a TTL index, e.g. Azure Cosmos DB.

connect-mongo will take care of removing expired sessions, using defined interval.

app.use(session({
  store: MongoStore.create({
    mongoUrl: 'mongodb://localhost/test-app',
    autoRemove: 'interval',
    autoRemoveInterval: 10 // In minutes. Default
  })
}));

Disable expired sessions cleaning

You are in production environnement and/or you manage the TTL index elsewhere.

app.use(session({
  store: MongoStore.create({
    mongoUrl: 'mongodb://localhost/test-app',
    autoRemove: 'disabled'
  })
}));

Lazy session update

If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refreshes the page, you can lazy update the session, by limiting a period of time.

app.use(express.session({
  secret: 'keyboard cat',
  saveUninitialized: false, // don't create session until something stored
  resave: false, //don't save session if unmodified
  store: MongoStore.create({
    mongoUrl: 'mongodb://localhost/test-app',
    touchAfter: 24 * 3600 // time period in seconds
  })
}));

by doing this, setting touchAfter: 24 * 3600 you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)

Transparent encryption/decryption of session data

When working with sensitive session data it is recommended to use encryption

const store = MongoStore.create({
  mongoUrl: 'mongodb://localhost/test-app',
  crypto: {
    secret: 'squirrel'
  }
})

Options

Connection-related options (required)

One of the following options should be provided. If more than one option are provided, each option will take precedence over others according to priority.

More options

Crypto-related options

Development

yarn install
docker-compose up -d
# Run these 2 lines in 2 shell
yarn watch:build
yarn watch:test

Example application

yarn link
cd example
yarn link "connect-mongo"
yarn install
yarn start

Release

Since I cannot access the setting page. I can only do it manually.

1. Bump version, update CHANGELOG.md and README. Commit and push.
2. Run yarn build && yarn test && npm publish
3. git tag vX.Y.Z && git push --tags

License

The MIT License