@thi.ng/server 0.10.4 → 0.11.0

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Change Log
 
-- **Last updated**: 2025-05-28T12:02:40Z
+- **Last updated**: 2025-06-05T12:59:44Z
 - **Generator**: [thi.ng/monopub](https://thi.ng/monopub)
 
 All notable changes to this project will be documented in this file.
@@ -11,6 +11,12 @@ See [Conventional Commits](https://conventionalcommits.org/) for commit guidelin
 **Note:** Unlisted _patch_ versions only involve non-code or otherwise excluded changes
 and/or version bumps of transitive dependencies.
 
+## [0.11.0](https://github.com/thi-ng/umbrella/tree/@thi.ng/server@0.11.0) (2025-06-05)
+
+#### 🚀 Features
+
+- force expire session cookie if invalid session ([ac6c208](https://github.com/thi-ng/umbrella/commit/ac6c208))
+
 ## [0.10.0](https://github.com/thi-ng/umbrella/tree/@thi.ng/server@0.10.0) (2025-04-16)
 
 #### 🚀 Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thi.ng/server",
-  "version": "0.10.4",
+  "version": "0.11.0",
   "description": "Minimal HTTP server with declarative routing, static file serving and freely extensible via pre/post interceptors",
   "type": "module",
   "module": "./index.js",
@@ -167,5 +167,5 @@
     "status": "alpha",
     "year": 2024
   },
-  "gitHead": "61c3833b7ef7d044621454b5ea4af885d39f065e\n"
+  "gitHead": "5a1224bbd501c0dad203fa231749f21740350db7\n"
 }

package/session/session.d.ts

@@ -87,6 +87,12 @@ export declare class SessionInterceptor<CTX extends RequestCtx = RequestCtx, SES
     replaceSession(ctx: CTX): Promise<SESSION | undefined>;
     withSession(res: ServerResponse, session: SESSION): ServerResponse<import("http").IncomingMessage>;
     validateSession(cookie: string): Promise<SESSION | undefined>;
+    /**
+     * Appends `set-cookie` header which forces immediate expiry of session cookie.
+     *
+     * @param ctx
+     */
+    expireCookie(ctx: CTX): void;
 }
 /**
  * Factory function to create a new {@link SessionInterceptor} instance

package/session/session.js

@@ -29,6 +29,7 @@ class SessionInterceptor {
     if (cookie) {
       session = await this.validateSession(cookie);
       if (!session) {
+        this.expireCookie(ctx);
         ctx.res.forbidden();
         return false;
       }
@@ -56,10 +57,7 @@ class SessionInterceptor {
     if (await this.store.delete(sessionID)) {
       ctx.logger.info("delete session:", sessionID);
       ctx.session = void 0;
-      ctx.res.appendHeader(
-        "set-cookie",
-        `${this.cookieName}=;Expires=Thu, 01 Jan 1970 00:00:00 GMT;${this.cookieOpts}`
-      );
+      this.expireCookie(ctx);
     }
   }
   /**
@@ -117,6 +115,17 @@ class SessionInterceptor {
     const sameLength = actual.length === expected.length;
     return timingSafeEqual(sameLength ? actual : expected, expected) && sameLength ? session : void 0;
   }
+  /**
+   * Appends `set-cookie` header which forces immediate expiry of session cookie.
+   *
+   * @param ctx
+   */
+  expireCookie(ctx) {
+    ctx.res.appendHeader(
+      "set-cookie",
+      `${this.cookieName}=;Expires=Thu, 01 Jan 1970 00:00:00 GMT;${this.cookieOpts}`
+    );
+  }
 }
 const sessionInterceptor = (opts) => new SessionInterceptor(opts);
 const createSession = (ctx) => ({