Skip to content

Commit

Permalink
redistore.go: Should delete session when MaxAge <= 0
Browse files Browse the repository at this point in the history
  • Loading branch information
dbellinghoven committed Jun 26, 2018
1 parent 09f58f6 commit 715bb32
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion redistore.go
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ func (s *RediStore) New(r *http.Request, name string) (*sessions.Session, error)
// Save adds a single session to the response.
func (s *RediStore) Save(r *http.Request, w http.ResponseWriter, session *sessions.Session) error {
// Marked for deletion.
if session.Options.MaxAge < 0 {
if session.Options.MaxAge <= 0 {
if err := s.delete(session); err != nil {
return err
}
Expand Down

1 comment on commit 715bb32

@harperj1029
Copy link

@harperj1029 harperj1029 commented on 715bb32 Nov 14, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is causing issues whereby "session" cookies are no longer created properly. "Session" cookies rely on the MaxAge == 0 when used in consumers like echo-session. Max-age means the following (copied from ipfans/echo-session/session.go lines 28-30):
MaxAge=0 means no 'Max-Age' attribute specified.
MaxAge<0 means delete cookie now, equivalently 'Max-Age: 0'.
MaxAge>0 means Max-Age attribute present and given in second

With this change, the code ends up setting an empty-valued cookie when a session-only (aka "Remember me" is unchecked) is desired.

Please sign in to comment.