feat: use env var for session store store #585
Conversation
|
""" WalkthroughThe session store setup in the server was refactored for improved type safety and maintainability. Configuration was extracted into a constant with a new interface, session secret sourcing was updated, error handling was refined, and session and cookie options were adjusted, including dynamic secure flag handling and a shorter prune interval. The README was updated to document the new optional Changes
Sequence Diagram(s)sequenceDiagram
participant Env as Environment
participant Server as server.ts
participant PgSession as PostgreSQL Session Store
participant Middleware as Session Middleware
Env->>Server: Provide SESSION_SECRET, NODE_ENV
Server->>PgSession: Initialize sessionStore with options (prune interval, error handler, etc.)
Server->>Middleware: Configure with sessionStore, secret, and cookie options
Middleware->>PgSession: Manage sessions (store, prune, etc.)
Possibly related PRs
Suggested labels
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
server/src/server.ts (2)
62-66: Improved session configuration with environment variable!Using an environment variable for the session secret is a security best practice. Changing
saveUninitializedtofalsealso helps prevent storing empty sessions.However, consider adding a warning log when using the default session secret in production.
- secret: process.env.SESSION_SECRET || 'mx-session', + secret: process.env.SESSION_SECRET || (() => { + const defaultSecret = 'mx-session'; + if (process.env.NODE_ENV === 'production') { + logger.log('warn', 'Using default session secret in production environment!'); + } + return defaultSecret; + })(),
67-69: Good dynamic cookie security configuration!Setting the secure flag based on the environment is a good practice. Consider also adding the
httpOnlyandsameSiteattributes for enhanced security.cookie: { secure: process.env.NODE_ENV === 'production', + httpOnly: true, + sameSite: process.env.NODE_ENV === 'production' ? 'strict' : 'lax', maxAge: 24 * 60 * 60 * 1000, }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
server/src/server.ts(1 hunks)
🔇 Additional comments (2)
server/src/server.ts (2)
42-48: Good addition of type safety with PgStoreOptions interface!The introduction of this interface improves code maintainability and provides better type checking for the PostgreSQL session store configuration.
50-58: Good refactoring of session store configuration!Extracting the session store configuration into a separate constant improves code organization. The shorter pruneSessionInterval (15 minutes vs 1 hour) will help clean up expired sessions more frequently. The error logging with the specific error message is also a good improvement.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
README.md (1)
101-101: Improve grammar and clarity for the SESSION_SECRET “If Not Set” note
The phrase “Recommended to define your own session secret…” is a fragment and reads more clearly as a complete sentence. For example:-| Uses default secret. Recommended to define your own session secret to avoid session hijacking. +| Uses default secret; it is recommended that you define your own session secret to avoid session hijacking.🧰 Tools
🪛 LanguageTool
[grammar] ~101-~101: The verb ‘Recommended’ is used with the gerund form.
Context: ... | Uses default secret. Recommended to define your own session secret to avoid sessio...(ADMIT_ENJOY_VB)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
README.md(1 hunks)
🧰 Additional context used
🪛 LanguageTool
README.md
[grammar] ~101-~101: The verb ‘Recommended’ is used with the gerund form.
Context: ... | Uses default secret. Recommended to define your own session secret to avoid sessio...
(ADMIT_ENJOY_VB)
amhsirak
added
Scope: Documentation
Summary by CodeRabbit