Expire sessions form the same user about node-connect-pg-simple

[voxpelli]

This sounds like a generic issue that all session stores for Express would have? No matter if they are stored in Postgres, MongoDB, Redis, MySQL or something else – if one wants it to be unique then I'm not really sure it belongs just in the session store.

Have you found out how others have solved this with Express? Is there some practice for limiting the amount of sessions per user? If it's just a matter of adding support for an established practice, then I may consider doing so – but adding this as a new unique feature kind of feels like it goes against the simple in the name of this modules. What do you think?

[jhihn]

I thought "simple" referred to the configuation.

There appears to be no feature like this in node yet. When i talk to the express/connect people they say no session store implements this, and they don't make everyone upgrade unless the session storea support it already. Whe i talk to the session stores, they say express/connect does not implement this, so I'm in the situation that this is clearly a useful and needed feature, but due to a chicken and egg problem, it will never happen.

I think the express/connect people want a proven api to use along with a reference implementation to verify against before they ask all the session stores to implement it.

[voxpelli]

The tricky thing would probably be to define an API for explaining the new constraints to the module in a generic way – easier would probably be to just subclass this module and wrap an extra step prior to the set() and/or get() methods where the specific constraints needed are enforced – like the passport user or something.

Depending on the size of ones applications one would probably also want some indexes added to those specific keys in the JSON as well – so that things doesn't get too slow – also something that's hard to do in a generic way.

Something else to think about as well is how one would go about forcibly expiring a session – there might be some edge cases where a session might have been fetched, but not yet updated, when it's expired – perhaps causing it to get recreated when it actually do get around to updating itself.

Does the subclass-route sounds like a possible way forward? To eg. create a passport-specific subclass of this?