Why are Options stored on each session record instead of the session store?

[xeoncross]

Why are Options stored on each session record instead of the session store?

[elithrar]

Well before my time, but it would be a breaking change. One benefit to this approach is that it allows you to expire (by setting MaxAge: -1) sessions - say, when you want to log a user out, or otherwise mutate a user session directly.

[xeoncross]

Yes, I outlined that approach as a possible reason, I'm just not sure why that would be used as it seems like bad practice to change session's duration individually (along with not bothering to store these unique durations). That would lead to a testing nightmare and the purpose of logging accounts in/out is better served without setting lifespans unique to each session cookie.

I assume the original author had a specific use-case in mind, but perhaps it was just convenience for setting the cookie options.

[elithrar]

I think you might be overstating the “testing nightmare” part :) I do think it’s a legitimate use-case to expire sessions; or set a session cookie that only lives for that browser session based on user input (“remember me”). Regardless, the original motivation was lost to the annals of time - this package is many years old, especially compared to most Go packages.

[xeoncross]

I do think it’s a legitimate use-case to expire sessions; or set a session
cookie that only lives for that browser session based on user input
(“remember me”).

I agree they are legitimate needs, but those are usually handled in a different way than setting different session cookie timestamps for each user. Expiring session cookies can be done universally with a single Max-Age set to 0 (or negative) and doesn't need to be tracked in all fifty thousand user sessions instances. Likewise, "remember me" functionality is generally handled by a separate cookie, not a parameter stored in the users current session. In fact, sessions are usually stored server side and culled after X time periods regardless of what the client cookie says.

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.