Narcissistic Passion Minified

    TypeScript icon, indicating that this package has built-in type declarations

    4.6.0 • Public • Published


    MongoDB session store for Connect and Express written in Typescript.

    npm version downloads Sanity check Coverage Status

    Breaking change in V4 and rewritten the whole project using Typescript. Please checkout the migration guide and changelog for details.


    npm install connect-mongo
    yarn add connect-mongo
    • You may also need to run install mongodb if you do not have it installed already because mongodb is not a peerDependencies instead.
    • If you are upgrading from v3.x to v4, please checkout the migration guide for details.
    • If you are upgrading v4.x to latest version, you may check the example and options for details.


    For extended compatibility, see previous versions v3.x. But please note that we are not maintaining v3.x anymore.


    Express or Connect integration

    Express 4.x, 5.0 and Connect 3.x:

    const session = require('express-session');
    const MongoStore = require('connect-mongo');
      secret: 'foo',
      store: MongoStore.create(options)
    import session from 'express-session'
    import MongoStore from 'connect-mongo'
      secret: 'foo',
      store: MongoStore.create(options)

    Connection to MongoDB

    In many circumstances, connect-mongo will not be the only part of your application which need a connection to a MongoDB database. It could be interesting to re-use an existing connection.

    Alternatively, you can configure connect-mongo to establish a new connection.

    Create a new connection from a MongoDB connection string

    MongoDB connection strings are the best way to configure a new connection. For advanced usage, more options can be configured with mongoOptions property.

    // Basic usage
      store: MongoStore.create({ mongoUrl: 'mongodb://localhost/test-app' })
    // Advanced usage
      store: MongoStore.create({
        mongoUrl: 'mongodb://user12345:foobar@localhost/test-app?authSource=admin&w=1',
        mongoOptions: advancedOptions // See below for details

    Re-use an existing native MongoDB driver client promise

    In this case, you just have to give your MongoClient instance to connect-mongo.

    ** There are many ways to create MongoClient.
    ** You should refer to the driver documentation.
    // Database name present in the connection string will be used
      store: MongoStore.create({ clientPromise })
    // Explicitly specifying database name
      store: MongoStore.create({
        dbName: 'test-app'

    Known issues

    Known issues in GitHub Issues page.

    Native autoRemove causing error on close

    • Calling close() immediately after creating the session store may cause error when the async index creation is in process when autoRemove: 'native'. You may want to manually manage the autoRemove index. #413

    MongoError exports circular dependency

    The following error can be safely ignore from official reply.

    (node:16580) Warning: Accessing non-existent property 'MongoError' of module exports inside circular dependency
    (Use `node --trace-warnings ...` to show where the warning was created)

    Existing encrypted v3.2.0 sessions are not decrypted correctly by v4

    v4 cannot decrypt the session encrypted from v3.2 due to a bug. Please take a look on this issue for possible workaround. #420


    A MongoStore instance will emit the following events:

    Event name Description Payload
    create A session has been created sessionId
    touch A session has been touched (but not modified) sessionId
    update A session has been updated sessionId
    set A session has been created OR updated (for compatibility purpose) sessionId
    destroy A session has been destroyed manually sessionId

    Session expiration

    When the session cookie has an expiration date, connect-mongo will use it.

    Otherwise, it will create a new one, using ttl option.

      store: MongoStore.create({
        mongoUrl: 'mongodb://localhost/test-app',
        ttl: 14 * 24 * 60 * 60 // = 14 days. Default

    Note: Each time an user interacts with the server, its session expiration date is refreshed.

    Remove expired sessions

    By default, connect-mongo uses MongoDB's TTL collection feature (2.2+) to have mongod automatically remove expired sessions. But you can change this behavior.

    Set MongoDB to clean expired sessions (default mode)

    connect-mongo will create a TTL index for you at startup. You MUST have MongoDB 2.2+ and administration permissions.

      store: MongoStore.create({
        mongoUrl: 'mongodb://localhost/test-app',
        autoRemove: 'native' // Default

    Note: If you use connect-mongo in a very concurrent environment, you should avoid this mode and prefer setting the index yourself, once!

    Set the compatibility mode

    In some cases you can't or don't want to create a TTL index, e.g. Azure Cosmos DB.

    connect-mongo will take care of removing expired sessions, using defined interval.

      store: MongoStore.create({
        mongoUrl: 'mongodb://localhost/test-app',
        autoRemove: 'interval',
        autoRemoveInterval: 10 // In minutes. Default

    Disable expired sessions cleaning

    You are in production environnement and/or you manage the TTL index elsewhere.

      store: MongoStore.create({
        mongoUrl: 'mongodb://localhost/test-app',
        autoRemove: 'disabled'

    Lazy session update

    If you are using express-session >= 1.10.0 and don't want to resave all the session on database every single time that the user refresh the page, you can lazy update the session, by limiting a period of time.

      secret: 'keyboard cat',
      saveUninitialized: false, // don't create session until something stored
      resave: false, //don't save session if unmodified
      store: MongoStore.create({
        mongoUrl: 'mongodb://localhost/test-app',
        touchAfter: 24 * 3600 // time period in seconds

    by doing this, setting touchAfter: 24 * 3600 you are saying to the session be updated only one time in a period of 24 hours, does not matter how many request's are made (with the exception of those that change something on the session data)

    Transparent encryption/decryption of session data

    When working with sensitive session data it is recommended to use encryption

    const store = MongoStore.create({
      mongoUrl: 'mongodb://localhost/test-app',
      crypto: {
        secret: 'squirrel'


    Connection-related options (required)

    One of the following options should be provided. If more than one option are provided, each option will take precedence over others according to priority.

    Priority Option Description
    1 mongoUrl A connection string for creating a new MongoClient connection. If database name is not present in the connection string, database name should be provided using dbName option.
    2 clientPromise A Promise that is resolved with MongoClient connection. If the connection was established without database name being present in the connection string, database name should be provided using dbName option.
    3 client An existing MongoClient connection. If the connection was established without database name being present in the connection string, database name should be provided using dbName option.

    More options

    Option Default Description
    mongoOptions { useUnifiedTopology: true } Options object for MongoClient.connect() method. Can be used with mongoUrl option.
    dbName A name of database used for storing sessions. Can be used with mongoUrl, or clientPromise options. Takes precedence over database name present in the connection string.
    collectionName 'sessions' A name of collection used for storing sessions.
    ttl 1209600 The maximum lifetime (in seconds) of the session which will be used to set session.cookie.expires if it is not yet set. Default is 14 days.
    autoRemove 'native' Behavior for removing expired sessions. Possible values: 'native', 'interval' and 'disabled'.
    autoRemoveInterval 10 Interval (in minutes) used when autoRemove option is set to interval.
    touchAfter 0 Interval (in seconds) between session updates.
    stringify true If true, connect-mongo will serialize sessions using JSON.stringify before setting them, and deserialize them with JSON.parse when getting them. This is useful if you are using types that MongoDB doesn't support.
    serialize Custom hook for serializing sessions to MongoDB. This is helpful if you need to modify the session before writing it out.
    unserialize Custom hook for unserializing sessions from MongoDB. This can be used in scenarios where you need to support different types of serializations (e.g., objects and JSON strings) or need to modify the session before using it in your app.
    writeOperationOptions Options object to pass to every MongoDB write operation call that supports it (e.g. update, remove). Useful for adjusting the write concern. Only exception: If autoRemove is set to 'interval', the write concern from the writeOperationOptions object will get overwritten.
    transformId Transform original sessionId in whatever you want to use as storage key.
    crypto Crypto related options. See below.

    Crypto-related options

    Option Default Description
    secret false Enables transparent crypto in accordance with OWASP session management recommendations.
    algorithm 'aes-256-gcm' Allows for changes to the default symmetric encryption cipher. See crypto.getCiphers() for supported algorithms.
    hashing 'sha512' May be used to change the default hashing algorithm. See crypto.getHashes() for supported hashing algorithms.
    encodeas 'hex' Specify to change the session data cipher text encoding.
    key_size 32 When using varying algorithms the key size may be used. Default value 32 is based on the AES blocksize.
    iv_size 16 This can be used to adjust the default IV size if a different algorithm requires a different size.
    at_size 16 When using newer AES modes such as the default GCM or CCM an authentication tag size can be defined.


    yarn install
    docker-compose up -d
    # Run these 2 lines in 2 shell
    yarn watch:build
    yarn watch:test

    Example application

    yarn link
    cd example
    yarn link "connect-mongo"
    yarn install
    yarn start


    Since I cannot access the setting page. I can only do it manually.

    1. Bump version, update and README. Commit and push.
    2. Run yarn build && yarn test && npm publish
    3. git tag vX.Y.Z && git push --tags


    The MIT License


    npm i connect-mongo

    DownloadsWeekly Downloads






    Unpacked Size

    109 kB

    Total Files


    Last publish


    • jdesboeufs
    • mingchuno