MongoDB session store for Express and Connect
- Support Express
- Support Express
- Support Mongoose
- Support native MongoDB driver
- Support Node.js
5.0 and Connect
var session = require'express-session';var MongoStore = require'connect-mongo'session;appusesessionsecret: 'foo'store: options;
3.x and Connect
var MongoStore = require'connect-mongo'express;appuseexpresssessionsecret: 'foo'store: options;
2.x, just replace
In many circumstances,
connect-mongo will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.
Alternatively, you can configure
connect-mongo to establish a new connection.
var mongoose = require'mongoose';// Basic usagemongooseconnectconnectionOptions;appusesessionstore: mongooseConnection: mongooseconnection;// Advanced usagevar connection = mongoosecreateConnectionconnectionOptions;appusesessionstore: mongooseConnection: connection;
In this case, you just have to give your
Db instance to
If the connection is not opened,
connect-mongo will do it for you.
/*** There are many ways to create dbInstance.** You should refer to the driver documentation.*/appusesessionstore: db: dbInstance;
// Basic usageappusesessionstore: url: 'mongodb://localhost/test-app';// Advanced usageappusesessionstore:url: 'mongodb://user12345:foobar@localhost/test-app?authSource=admins&w=1'mongoOptions: advancedOptions // See below for details;
For compatibility purpose,
connect-mongo can create a basic connection string and set some options for you.
You can't use
mongoOptions if you choose this mode.
appusesessionstore:// Basic usagehost: 'localhost' // Default, optionalport: 27017 // Default, optionaldb: 'test-app' // Required// Basic authentication (optional)username: 'user12345'password: 'foobar'// Advanced options (optional)autoReconnect: true // Defaultw: 1 // Default,ssl: false // Default;
When the session cookie has an expiration date,
connect-mongo will use it.
Otherwise, it will create a new one, using
appusesessionstore:url: 'mongodb://localhost/test-app'ttl: 14 * 24 * 60 * 60 // = 14 days. Default;
Note: Each time an user interacts with the server, its session expiration date is refreshed.
connect-mongo uses MongoDB's TTL collection feature (2.2+) to have mongod automatically remove expired sessions. But you can change this behavior.
connect-mongo will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.
appusesessionstore:url: 'mongodb://localhost/test-app'autoRemove: 'native' // Default;
Note: If you use
connect-mongo in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!
You have an older MongoDB version (compatible with connect-mongo) or you can't or don't want to create a TTL index.
connect-mongo will take care of removing expired sessions, using defined interval.
appusesessionstore:url: 'mongodb://localhost/test-app'autoRemove: 'interval'autoRemoveInterval: 10 // In minutes. Default;
You are in production environnement and/or you manage the TTL index elsewhere.
appusesessionstore:url: 'mongodb://localhost/test-app'autoRemove: 'disabled';
If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refresh the page, you can lazy update the session, by limiting a period of time.
appuseexpresssessionsecret: 'keyboard cat'saveUninitialized: false // don't create session until something storedresave: false //don't save session if unmodifiedstore:url: 'mongodb://localhost/test-app'touchAfter: 24 * 3600 // time period in seconds;
by doing this, setting
touchAfter: 24 * 3600 you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)
MemoryStore. Useful if you want to use MemoryStore in some case, like in development environment.
stringifyIf true, connect-mongo will serialize sessions using
JSON.stringifybefore setting them, and deserialize them with
JSON.parsewhen getting them. (optional, default: true). This is useful if you are using types that MongoDB doesn't support.
serializeCustom hook for serializing sessions to MongoDB. This is helpful if you need to modify the session before writing it out.
unserializeCustom hook for unserializing sessions from MongoDB. This can be used in scenarios where you need to support different types of serializations (e.g., objects and JSON strings) or need to modify the session before using it in your app.
hash(optional) Hash is an object, which will determine wether hash the sid in mongo, since it's not undefined, means sid will be hashed
hash.saltSalt will be used to hash the sid in mongo, default salt is "connect-mongo"
hash.algorithmHash algorithm, default algorithm is "sha1"
The tests use a database called
(The MIT License)
Copyright (c) 2011-2015 Casey Banner <email@example.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.