@thi.ng/server 0.10.4 → 0.11.1

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Change Log
 
-- **Last updated**: 2025-05-28T12:02:40Z
+- **Last updated**: 2025-06-09T17:24:08Z
 - **Generator**: [thi.ng/monopub](https://thi.ng/monopub)
 
 All notable changes to this project will be documented in this file.
@@ -11,6 +11,12 @@ See [Conventional Commits](https://conventionalcommits.org/) for commit guidelin
 **Note:** Unlisted _patch_ versions only involve non-code or otherwise excluded changes
 and/or version bumps of transitive dependencies.
 
+## [0.11.0](https://github.com/thi-ng/umbrella/tree/@thi.ng/server@0.11.0) (2025-06-05)
+
+#### 🚀 Features
+
+- force expire session cookie if invalid session ([ac6c208](https://github.com/thi-ng/umbrella/commit/ac6c208))
+
 ## [0.10.0](https://github.com/thi-ng/umbrella/tree/@thi.ng/server@0.10.0) (2025-04-16)
 
 #### 🚀 Features

package/README.md

@@ -7,7 +7,7 @@
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/109331703950160316?domain=https%3A%2F%2Fmastodon.thi.ng&style=social)](https://mastodon.thi.ng/@toxi)
 
 > [!NOTE]
-> This is one of 208 standalone projects, maintained as part
+> This is one of 209 standalone projects, maintained as part
 > of the [@thi.ng/umbrella](https://github.com/thi-ng/umbrella/) monorepo
 > and anti-framework.
 >
@@ -164,7 +164,7 @@ For Node.js REPL:
 const ser = await import("@thi.ng/server");
 ```
 
-Package sizes (brotli'd, pre-treeshake): ESM: 6.27 KB
+Package sizes (brotli'd, pre-treeshake): ESM: 6.32 KB
 
 ## Dependencies
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thi.ng/server",
-  "version": "0.10.4",
+  "version": "0.11.1",
   "description": "Minimal HTTP server with declarative routing, static file serving and freely extensible via pre/post interceptors",
   "type": "module",
   "module": "./index.js",
@@ -39,20 +39,20 @@
     "tool:tangle": "../../node_modules/.bin/tangle src/**/*.ts"
   },
   "dependencies": {
-    "@thi.ng/api": "^8.11.28",
-    "@thi.ng/arrays": "^2.11.1",
-    "@thi.ng/cache": "^2.3.33",
-    "@thi.ng/checks": "^3.7.8",
-    "@thi.ng/errors": "^2.5.34",
-    "@thi.ng/file-io": "^2.1.37",
-    "@thi.ng/leaky-bucket": "^0.2.6",
-    "@thi.ng/logger": "^3.1.9",
-    "@thi.ng/mime": "^2.7.10",
-    "@thi.ng/paths": "^5.2.11",
-    "@thi.ng/router": "^4.1.30",
-    "@thi.ng/strings": "^3.9.13",
-    "@thi.ng/timestamp": "^1.1.13",
-    "@thi.ng/uuid": "^1.1.25"
+    "@thi.ng/api": "^8.11.29",
+    "@thi.ng/arrays": "^2.11.2",
+    "@thi.ng/cache": "^2.3.34",
+    "@thi.ng/checks": "^3.7.9",
+    "@thi.ng/errors": "^2.5.35",
+    "@thi.ng/file-io": "^2.1.38",
+    "@thi.ng/leaky-bucket": "^0.2.7",
+    "@thi.ng/logger": "^3.1.10",
+    "@thi.ng/mime": "^2.7.11",
+    "@thi.ng/paths": "^5.2.12",
+    "@thi.ng/router": "^4.1.31",
+    "@thi.ng/strings": "^3.9.14",
+    "@thi.ng/timestamp": "^1.1.14",
+    "@thi.ng/uuid": "^1.1.26"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",
@@ -167,5 +167,5 @@
     "status": "alpha",
     "year": 2024
   },
-  "gitHead": "61c3833b7ef7d044621454b5ea4af885d39f065e\n"
+  "gitHead": "93cdcd8db4d4669561a7f0ebc47697bdbfd04214\n"
 }

package/session/session.d.ts

@@ -87,6 +87,12 @@ export declare class SessionInterceptor<CTX extends RequestCtx = RequestCtx, SES
     replaceSession(ctx: CTX): Promise<SESSION | undefined>;
     withSession(res: ServerResponse, session: SESSION): ServerResponse<import("http").IncomingMessage>;
     validateSession(cookie: string): Promise<SESSION | undefined>;
+    /**
+     * Appends `set-cookie` header which forces immediate expiry of session cookie.
+     *
+     * @param ctx
+     */
+    expireCookie(ctx: CTX): void;
 }
 /**
  * Factory function to create a new {@link SessionInterceptor} instance

package/session/session.js

@@ -29,6 +29,7 @@ class SessionInterceptor {
     if (cookie) {
       session = await this.validateSession(cookie);
       if (!session) {
+        this.expireCookie(ctx);
         ctx.res.forbidden();
         return false;
       }
@@ -56,10 +57,7 @@ class SessionInterceptor {
     if (await this.store.delete(sessionID)) {
       ctx.logger.info("delete session:", sessionID);
       ctx.session = void 0;
-      ctx.res.appendHeader(
-        "set-cookie",
-        `${this.cookieName}=;Expires=Thu, 01 Jan 1970 00:00:00 GMT;${this.cookieOpts}`
-      );
+      this.expireCookie(ctx);
     }
   }
   /**
@@ -117,6 +115,17 @@ class SessionInterceptor {
     const sameLength = actual.length === expected.length;
     return timingSafeEqual(sameLength ? actual : expected, expected) && sameLength ? session : void 0;
   }
+  /**
+   * Appends `set-cookie` header which forces immediate expiry of session cookie.
+   *
+   * @param ctx
+   */
+  expireCookie(ctx) {
+    ctx.res.appendHeader(
+      "set-cookie",
+      `${this.cookieName}=;Expires=Thu, 01 Jan 1970 00:00:00 GMT;${this.cookieOpts}`
+    );
+  }
 }
 const sessionInterceptor = (opts) => new SessionInterceptor(opts);
 const createSession = (ctx) => ({