Repository navigation
Sessions in parse-server doesn't seem to work the way I expected sessions to work #3387
Description
Hello Parse-Server elders
How are parse-server Sessions meant to work?
The way I thought Sessions work is that there is a timeout and a limit on the max session length. A timeout would be set to something like 30m, so if a client doesn't communicate with the server using the sessionToken at least once every 30m, then the session would timeout and the sessionToken would no longer be usable.
But if the client does communicate using the sessionToken continuously, then they can communicate with the server up to a max session length, e.g. 8 hours or something.
However in parse-server there seems to only be a single sessionLength property. When you communicate with the server using the sessionToken, the expiresAt value doesn't seem to be updated. So parse-server's sessionLength is what I have been referring to in my example as "max session length" is that right?
The concept of the shorter timeout to verify the health of the client isn't present in parse-server is that right?
Thanks
Activity
wookiem commentedon Jan 31, 2017
I too couldn't find anything in the documentation. However, I did find a response on this topic from @flovilmart in serverfault (see link below). The guidance is as follows:
http://serverfault.com/questions/787470/implement-expire-inactive-session-feature-in-parse-server
I haven't tried it out yet, but I hope to do so this week.
hramos commentedon Feb 10, 2017
Hey, thanks for reporting this issue.
Can you please add all the info specified in the template? This is necessary for people to be able to understand and reproduce the issue being reported.
simonaberry commentedon Jan 31, 2019
I have a similar requirement (managing sessions across multiple tabs) and have been doing investigation into the matter. It appears that the
expireInactiveSessionsflag is defaulted totrueand ensures that thesessionLengthproperty is executed (ie your max session length).I therefore think we would need to implement our own solution, and have conceptually come up with the following approach:
Principle of Operation
client:
On application start :
IAmLoggedIn)window.onbeforeunload[triggers when closing tab or refreshing page]storage[triggers when data added to/removed from localStorage]PleaseDontCloseSession()cloud function // sets session expiry to 30 days from nowOnBeforeUnload: [tab closing/refreshing]
IAmLoggedIntoken from localStorageIAmEndingMySession()cloud code function // sets session expiry to 60s from nowOnStorage [localStorage changed]
IAmLoggedIn&& newValue === null -> runPleaseDontCloseSession()cloud function after a short delay // this should only trigger if another tab deleted theIAmLoggedIntokenserver:
IAmEndingMySession() cloud function
ExpiresAtto 60s from nowPleaseDontCloseSession() cloud function
ExpiresAtto 30 days from nowany feedback on the idea is appreciated (especially @flovilmart) - will report back once we have implemented...
simonaberry commentedon Feb 12, 2019
for anyone who reads this later... problem with the above approach is you cannot modify
expiresAt- it is a read only fieldso have to create your own
timesOutAtfield and use a background job to delete any 'timedout' sessions