feat(core): add expirationStrategy support for stateful sessions - #248
feat(core): add expirationStrategy support for stateful sessions#248halvaradop wants to merge 2 commits into
expirationStrategy support for stateful sessions#248Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughSession expiration settings move from nested JWT configuration to session-level configuration. Core types, expiration calculations, renewal flows, tests, and documentation are updated. Documentation navigation redirects ChangesSession expiration configuration
Documentation navigation
Generated route tree formatting
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant getSession
participant calcExpiration
participant SessionsAdapter
getSession->>calcExpiration: calculate expiration outcome
calcExpiration-->>getSession: return expiration result
getSession->>SessionsAdapter: persist expiration and lastActivityAt
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/src/content/docs/`(core)/configuration/session-strategies.mdx:
- Around line 34-36: The session strategy table’s expirationStrategy entry omits
supported values. Update the type and description in the expirationStrategy row
to include fixed, rolling, absolute, and sliding, matching SessionConfigBase and
the documented section below while preserving the existing default.
In `@packages/core/src/`@types/session.ts:
- Around line 168-190: Align SessionConfigBase.expirationStrategy with the
runtime default by documenting and declaring the unset value as "absolute"
rather than "fixed". Update the stateless and stateful session configuration
resolvers to use the same "absolute" fallback whenever expirationStrategy is
omitted.
- Around line 220-223: Update StatefulStrategyConfig and its runtime consumers
to preserve the old session configuration alias, marking it deprecated and
defining explicit precedence over database when both are provided; ensure
deleteStrategy and maxSessions are read from the selected configuration.
Alternatively, document this as a breaking change and update all runtime config
consumption accordingly.
In `@packages/core/src/session/stateful/getSession.ts`:
- Around line 134-144: Update the renewal logic around updateExpires in the
stateful session flow to enforce sessionConfig.maxDuration from
session.createdAt: cap expiresAt at the createdAt-based maximum, and skip the
adapter.updateSession renewal once that cap has been reached. Preserve the
existing expiry calculation and lastActivityAt update for sessions still within
the allowed duration.
- Around line 139-144: Update the renewal logic in getSession around
adapter.updateSession so persistence failures are handled separately from
session validation failures: preserve the already-valid session and existing
expiry when the renewal write fails, and only expose the renewed expiresAt after
updateSession succeeds. Prevent renewal errors from reaching the outer catch
that returns session: null and clears the cookie.
In `@packages/core/test/config/session.test.ts`:
- Line 51: Update the migration test fixtures at the referenced session
configurations to set expirationStrategy directly on session instead of
session.jwt.expirationStrategy. Ensure these tests exercise the current
session-level configuration path, while retaining a separate fixture only if
needed to cover deprecated fallback compatibility.
In `@skills/security-practices/SKILL.md`:
- Around line 200-202: Replace the session-level maxExpiration option with
maxDuration in the hardened configuration, preserving the existing 30-day value
and surrounding session settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c2c173e1-68ad-4b60-ba82-5371cd1b66fc
📒 Files selected for processing (16)
apps/tanstack-start/src/routeTree.gen.tsdocs/next.config.tsdocs/proxy.tsdocs/src/components/home/call-to-action.tsxdocs/src/content/docs/(core)/api-reference/server/createAuth.mdxdocs/src/content/docs/(core)/configuration/session-strategies.mdxpackages/core/CHANGELOG.mdpackages/core/src/@types/adapter.tspackages/core/src/@types/session.tspackages/core/src/jose.tspackages/core/src/session/stateful/getSession.tspackages/core/src/session/stateless/getSession.tspackages/core/src/session/stateless/refreshSession.tspackages/core/test/config/session.test.tsskills/create-auth/reference/create-auth.mdskills/security-practices/SKILL.md
💤 Files with no reviewable changes (1)
- docs/proxy.ts
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/core/src/session/stateless/getSession.ts`:
- Around line 29-35: Update the expiration handling in getSession around
calcStatelessExpiration so action === "invalid" returns { session: null, headers
} instead of the authenticated session; preserve the existing session return for
only "no_change" and "touch". Add a regression test covering a signed token
without an exp claim.
In `@skills/security-practices/SKILL.md`:
- Around line 230-240: Update the expiration design guidance around
`maxDuration` and `expirationStrategy` to state that `SessionConfigBase`
requires `maxDuration` for `absolute` and `sliding` strategies, and that it
bounds sliding-session renewal to prevent indefinite extension. Also recommend
setting `maxDuration` for `rolling` sessions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 255dfca7-a196-4cf0-8e44-a59209ad27c9
📒 Files selected for processing (11)
docs/src/content/docs/(core)/configuration/session-strategies.mdxpackages/core/src/@types/index.tspackages/core/src/@types/session.tspackages/core/src/session/stateful/getSession.tspackages/core/src/session/stateless/getSession.tspackages/core/src/shared/assert.tspackages/core/src/shared/logger.tspackages/core/src/shared/utils/session-strategy.tspackages/core/test/api/stateless/getSession.test.tspackages/core/test/config/session.test.tsskills/security-practices/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (3)
- packages/core/test/config/session.test.ts
- packages/core/src/session/stateful/getSession.ts
- docs/src/content/docs/(core)/configuration/session-strategies.mdx
| const calc = calcStatelessExpiration({ | ||
| exp, | ||
| maxAge, | ||
| strategy, | ||
| }) | ||
| if (calc.action === "no_change" || calc.action === "invalid" || calc.action === "touch") { | ||
| return { session, headers } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Reject sessions when expiration processing returns invalid.
calcStatelessExpiration returns invalid when exp is missing or expired. Lines 34-35 return the authenticated session for that result. An exp-less signed token can remain valid without an expiration.
Return session: null for invalid. Keep the existing session only for no_change and touch. Add a regression test for a token with no exp claim.
Proposed fix
- if (calc.action === "no_change" || calc.action === "invalid" || calc.action === "touch") {
+ if (calc.action === "invalid") {
+ return { session: null, headers: newHeaders }
+ }
+ if (calc.action === "no_change" || calc.action === "touch") {
return { session, headers }
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/core/src/session/stateless/getSession.ts` around lines 29 - 35,
Update the expiration handling in getSession around calcStatelessExpiration so
action === "invalid" returns { session: null, headers } instead of the
authenticated session; preserve the existing session return for only "no_change"
and "touch". Add a regression test covering a signed token without an exp claim.
| ## issuer, audience, maxDuration, and expiration design | ||
|
|
||
| - `issuer`: set canonical auth issuer URL. | ||
| - `audience`: set explicit service audience(s); avoid overly broad audiences. | ||
| - `maxAge`: session lifetime per token. | ||
| - `maxExpiration`: absolute cap to prevent indefinite extension. | ||
| - `maxDuration`: absolute cap to prevent indefinite extension. | ||
| - `expirationStrategy`: | ||
| - `absolute`: hard stop after max window (security-first default). | ||
| - `rolling`: extends active sessions; use with strict caps and monitoring. | ||
| - `fixed`: fixed TTL from issuance; no rolling extension. | ||
| - `sliding`: refreshes validity window with activity, bounded by `maxExpiration`. | ||
| - `sliding`: refreshes validity window with activity, bounded by `maxDuration`. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
State when maxDuration is required.
SessionConfigBase requires maxDuration for absolute and sliding strategies. The guidance currently describes it only as a cap. Without it, the expiration utility has no duration ceiling, so a sliding session can renew indefinitely. Document this requirement and recommend maxDuration for rolling sessions.
🧰 Tools
🪛 SkillSpector (2.4.4)
[error] 3: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 28: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 65: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 268: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/security-practices/SKILL.md` around lines 230 - 240, Update the
expiration design guidance around `maxDuration` and `expirationStrategy` to
state that `SessionConfigBase` requires `maxDuration` for `absolute` and
`sliding` strategies, and that it bounds sliding-session renewal to prevent
indefinite extension. Also recommend setting `maxDuration` for `rolling`
sessions.
1 participant
Summary by CodeRabbit
New Features
Deprecations
Documentation
/docsnow permanently redirects to/docs/introduction.