Session not set immediately after login

I’m using this library with express-session, passport, and the Passport Google OAuth2.0 lib. When the user approves of logging in and gets redirected, req.user is not set (nor, say, req.session.passport.user). I send this info over to the client, so that they know who is logged in. Because it isn’t sent, the client believes that the user has not logged in, and redirects them back to the login page. If the user then refreshes that page, things are set at that time, and they are considered logged in.

The cookie is set, but the presence of the cookie isn’t very reliable. For instance, when they’re logged out, the cookie currently sticks around.

I set this app by following this example, using the in-memory session. The user was set immediately on being redirected. When I refactored to add in this lib, it no longer worked the same way.

Is this an issue anyone else has run into before? I’ve tried switching around the resave and saveUnitialized options to see if those would affect this, but with no luck.

The code is pretty awful – I’m trying to get it to work before refactoring – but you can see the configuration here.

Results of the investigation:

• It’s also lagging behind when the user gets logged out. After hitting the /logout endpoint, they’re sent the user info until they refresh. Update: calling req.session.destroy explicitly fixed this. Full code at the end of this post.
• Switching to pg rather than pg-promise did not solve the issue
• Switching from multiple to a single process didn’t fix it either

Logout code

Simply calling req.logout() wasn’t working. Explicitly calling req.session.destroy(), on the other hand, forces the session to be destroyed 100% of the time.

app.get('/logout', (req, res) => {
  req.logout();
  req.session.destroy(function (err) {
    res.redirect('/login');
  });
});

[jamesplease]

For me, the issue turned out that Chrome doesn’t wait for the whole response before redirecting. So express-session’s attempt to save to the DB wasn’t completed before the new request began. You can force it to wait by delaying the call to the redirect until you’re sure that the session is saved. In my app, this looked like:

app.get('/auth/google/callback', passport.authenticate('google', redirects),
  function(req, res) {
    // Explicitly save the session before redirecting!
    req.session.save(() => {
      res.redirect('/success');
    })
  });

[jdposthuma]

Will send example tomorrow.

On Monday, July 4, 2016, James, please [e-mail] wrote:

@jdposthuma https://github.com/jdposthuma just tried that – didn’t work for me. I placed it between app.use(session({ … })) and app.use(passport.initialize(). Do you have an example app anywhere showing how you’ve configured it?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/voxpelli/node-connect-pg-simple/issues/31#issuecomment-230357314, or mute the thread https://github.com/notifications/unsubscribe/AOfspAtIiut9nDtVyxxH4HrQHRf59cyoks5qSX89gaJpZM4ISiZ1 .

Jason Posthuma Developer 303-210-4525