How long will express session last by default

0
votes

I want to know how long will express session last by default, i specified a session.cookie.maxAge for when remember me checkbox is enabled and it works fine, but the default value (when maxAge and expires aren't defined) is lasting forever even if i close the browser.

From Expressjs documentation :

cookie.expires Specifies the Date object to be the value for the Expires Set-Cookie attribute. By default, no expiration is set, and most clients will consider this a “non-persistent cookie” and will delete it on a condition like exiting a web browser application.

Note If both expires and maxAge are set in the options, then the last one defined in the object is what is used.

Note The expires option should not be set directly; instead only use the maxAge option.

If it's not possible to destroy session on browser close what is the recommended value of maxAge when remember-me is disabled ?

1
node.jsexpressexpress-session

1 Answers

0
votes

Totally depends on the nature of your application.

  • Applications of banking-nature won't keep it more than 15 minutes for security reasons.
  • Applications otherwise keep them until days, example Gmail, Facebook. Ofcourse, most of them have now migrated to JWT (JSON Web Tokens)