- Support Express up to
- Support all Connect versions
- Support Mongoose
- Support native MongoDB driver
- Support Node.js 8, 10 and 12
- Support MongoDB
3.2 - 4.0
For extended compatibility, see previous versions v2.0.3. But please note that we are not maintaining v2.x.x anymore.
Express or Connect integration
5.0 and Connect
const session = ;const MongoStore = session;app;
Connection to MongoDB
In many circumstances,
connect-mongo will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.
Alternatively, you can configure
connect-mongo to establish a new connection.
Re-use a Mongoose connection
const mongoose = ;// Basic usagemongoose;app;// Advanced usageconst connection = mongoose;app;
Re-use a native MongoDB driver client (or a promise)
In this case, you just have to give your
MongoClient instance to
/*** There are many ways to create MongoClient.** You should refer to the driver documentation.*/app;
Or just give a promise...
Create a new connection from a MongoDB connection string
// Basic usageapp;// Advanced usageapp;
MongoStore instance will emit the following events:
||A session has been created||
||A session has been touched (but not modified)||
||A session has been updated||
||A session has been created OR updated (for compatibility purpose)||
||A session has been destroyed manually||
When the session cookie has an expiration date,
connect-mongo will use it.
Otherwise, it will create a new one, using
Note: Each time an user interacts with the server, its session expiration date is refreshed.
Remove expired sessions
connect-mongo uses MongoDB's TTL collection feature (2.2+) to have mongod automatically remove expired sessions. But you can change this behavior.
Set MongoDB to clean expired sessions (default mode)
connect-mongo will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.
Note: If you use
connect-mongo in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!
Set the compatibility mode
You have an older MongoDB version (compatible with connect-mongo) or you can't or don't want to create a TTL index.
connect-mongo will take care of removing expired sessions, using defined interval.
Disable expired sessions cleaning
You are in production environnement and/or you manage the TTL index elsewhere.
Lazy session update
If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refresh the page, you can lazy update the session, by limiting a period of time.
by doing this, setting
touchAfter: 24 * 3600 you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)
Transparent encryption/decryption of session data
When working with sensitive session data it is recommended to use encryption
const store =url: 'mongodb://localhost/test-app'secret: 'squirrel'
MemoryStore. Useful if you want to use MemoryStore in some case, like in development environment.
stringifyIf true, connect-mongo will serialize sessions using
JSON.stringifybefore setting them, and deserialize them with
JSON.parsewhen getting them. (optional, default: true). This is useful if you are using types that MongoDB doesn't support.
serializeCustom hook for serializing sessions to MongoDB. This is helpful if you need to modify the session before writing it out.
unserializeCustom hook for unserializing sessions from MongoDB. This can be used in scenarios where you need to support different types of serializations (e.g., objects and JSON strings) or need to modify the session before using it in your app.
writeOperationOptionsOptions object to pass to every MongoDB write operation call that supports it (e.g.
remove). Useful for adjusting the write concern. Only exception: If
autoRemoveis set to
'interval', the write concern from the
writeOperationOptionsobject will get overwritten.
transformId(optional) Transform original sessionId in whatever you want to use as storage key.
secret(optional) Enables transparent crypto in accordance with OWASP session management recommendations.
algorithm(optional) Allows for changes to the default symmetric encryption cipher; default is
crypto.getCiphers()for supported algorithms.
hashing(optional) May be used to change the default hashing algorithm; default is
crypto.getHashes()for supported hashing algorithms.
encodeas(optional) Specify to change the session data cipher text encoding. Default is
key_size(optional) When using varying algorithms the key size may be used. Default is
32based on the
iv_size(optional) This can be used to adjust the default IV size if a different algorithm requires a different size. Default is
at_size(optional) When using newer
AESmodes such as the default
CCMan authentication tag size can be defined; default is
docker run --rm -p 27017:27017 mongo:3.6 yarn install yarn test
The tests use a database called
Open source projects and production apps using
connect-mongo. Feel free to add yours in a pull request.
- Builder Book: Open source web app to write and host documentation or sell books. Built with React, Material-UI, Next, Express, Mongoose, MongoDB.
The MIT License