last day (15 days later) » 

3:44 AM
0
Q: Very occasionally a user session is not deleted upon logout. Why might this happen?

myNewAccountEnvironment: Node.js, Express, Express-session, Redis, Digital Ocean Droplet Background: My app allows users to log into and out of an account that they create. Problem: Perhaps 1% or 2% of the time when a user logs out the session is not destroyed and the user can get back to their myAccount pa...

 
For starters, you should log any errors that req.session.destroy() sends to its callback. That throw new Error(err) doesn't do anything useful because you're inside an asynchronous callback so it won't be caught by any of your code, not even the wrapAsync(). Also, I would think you want to clear the cookie, even if req.session.destroy() has an error.
 
@jfriend00 Wow, as a Jr. dev maybe I'm missing an important concept. Aren't all sync errors automatically caught by Express and sent to the error handler? I thought wrapAsync could catch all Async errors and all sync errors would be caught automatically.
 
Nope. A plain asynchronous callback like this one is called with an empty call stack so there's none of your code that can catch anything you throw there. If you want to propagate errors, it would be better to promisify req.session.destroy() and then you could use wrapAsync() as intended to catch rejections or exceptions if you coded it correctly. Just try putting a throw new Error("hi") inside a setTimeout() callback and see if you can catch that with a try/catch around the outside of the setTimeout(). Hint: you can't.
In any case, this is probably a case where you'd rather log the error here and clear the cookie rather than let wrapAsync() handle the error any ways. The intention is to logout and if you clear the cookie, you will achieve that.
 
@jfriend00 That version of my logout was just one of many. I did have a version where res.clearCookie was called regardless. And yet still even in this case the same non-logout error occurred. So neither .destroy() nor .clearCookie() worked at the exact same time. Does that narrow my problem down at all? So it must be somewhere else?
 
If this code was always clearing the cookie, but you stayed logged in, then apparently this code wasn't getting called or process.env.SESSION_NAME was wrong or you weren't finishing the sending of the response (you have to send the response and the browser has to receive it for the cookie to get cleared).
 
3:44 AM
process.env.SESSION_NAME is 100% correct. So that means the code wasn't called. router.get('/logout', redirectLogin, middlewareUserAccounts.logout); It must be in redirectLogin. But for some reason the error never occurs on my desktop, only on linux.
 
Also, there could be timing issues. The cookie is not actually removed from the browser's cookie store until it receives the response. So, if you send some other request from the browser before this response gets back to the browser, the cookie will be sent with that 2nd request as it hasn't yet been removed from the browser's cookie storage.
 
@jfriend00 I updated my question with the hook that runs before logout. Is it possible that redirectLogin is creating a timing issue? That starts to make sense.
 
I don't see anything timing related in the redirectLogin middleware. It looks like it would throw if req.session is not present yet, but that wouldn't presumably be a normal path through the code as you'd have to be attempting to logout when you weren't logged in. Still probably should defend against that. Is the session middleware installed BEFORE all these other routes?
I just realized that on your computer where the problem never happens, you're not using redis as the session store. That also points to a timing issue because the timing of session-related operations will be different with redis vs. the memory store.
 
@jfriend00 app.use(session(... is inside app.js and located above any of my endpoints which are called with app.use(endpointsUserAccounts); etc. But you're right this has got to be a timing issue.
@jfriend00 Is there a way to wrap the code inside of my logout middleware in a Promise or something similar? And then I don't get to the home page redirect until I absolutely know that the cookie and session are destroyed.
 
The logout() function already waits for the req.session.destroy() to finish before it redirects to the home page. There is the other issue I mentioned about the throw if destroy fails. If you have ALL the code on github or something you can drop a link to, I can look through it for other things.
 
3:52 AM
Sure thing! Is this chat private? if not could I send you think like to the repo in some other way?
Hmm... that doesn't look right. Should read, If not could I send you the link to the repo in some other way?
 

last day (15 days later) »