Express-Session creating too many sessions in DynamoDB. (Using Google One Tap) - express

Question

I am using Google One Tap to log into a webpage and trying to use AWS' DynamoDB to manage the session info. I previously tried Elasticache and couldnt view the clusters/connect to the DB, so I switched. Now, I have the opposite problem where I'll get 20-100+ sessions saved to DyanmoDB in a 5-30 min span when I go to the login page 1-2x. I thought the problem was having saveUninitialized set to true, but that has not changed anything.
Would really appreciate any suggestions on how to debug this/what's going on/alternatives for session management
const session = require('express-session')
const DynamoDBStore = require('connect-dynamodb')(session)
const options = {
table: 'my-sessions',
AWSConfigJSON: {
accessKeyId: process.env.ACCESSKEYID,
secretAccessKey: process.env.SECRETACCESSKEY,
region: 'us-east'
}
}
app.use(session({
genid: (req) => {
return uuidv4() // use UUIDs for session IDs
},
cookie: {
secure: true
},
store: new DynamoDBStore(options),
secret: 'mysecretkey',
resave: false,
cookie: {
maxAge: 5*60*1000, //set to 5 min
},
saveUninitialized: false,
name: 'id',
rolling: true
}));
Edit: Adding my Google Auth process just in case I modified it/managing sessions incorrectly
This function is on the client side and runs once the user selects the profile to log in with
function handleCredentialResponse(response) {
var id_token = response.credential;
var xhr = new XMLHttpRequest();
xhr.open('POST', '/auth'); // have been getting a 404 error in the console, but I get logs in the terminal that indicate /auth was reached? secondary, but would love any insight into this
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.onload = function() {
console.log('Signed in as: ' + xhr.responseText);
};
xhr.send('idtoken=' + id_token);
}
This is on the server side, and what a POST req to /auth hits:
const client = new OAuth2Client(process.env.GOOGLE_CLIENT_ID);
exports.authLogin = (req, res, next) => {
async function verify() {
// google API function that verifies the JWT signature, the aud claim, the exp claim, and the iss claim.
const ticket = await client.verifyIdToken({
idToken: req.body.idtoken, // passed from handleCredentialResponse function
audience: process.env.GOOGLE_CLIENT_ID,
});
const payload = ticket.getPayload();
const userid = payload['sub'];
req.session.user = userid
req.session.auth = true // logged in
req.session.save()
}
verify().catch(console.error);
next()
}

Answer 1

I'm not quite following everything you're asking here, but I do see an implementation mistake that could create problems. In your exports.authLogin() function, you are calling next() before the asynchronous portion of your middleware has finished. Instead, you should do this:
exports.authLogin = (req, res, next) => {
async function verify() {
// google API function that verifies the JWT signature, the aud claim, the exp claim, and the iss claim.
const ticket = await client.verifyIdToken({
idToken: req.body.idtoken, // passed from handleCredentialResponse function
audience: process.env.GOOGLE_CLIENT_ID,
});
const payload = ticket.getPayload();
const userid = payload['sub'];
req.session.user = userid
req.session.auth = true // logged in
req.session.save()
}
verify().then(next).catch(err => {
console.error(err);
next(err);
});
}
This moves the call to next() into a .then() handler so it does not advance to the next request handler in the chain until after verify() is done. In addition, if verify() fails, it also calls next(err) rather than just doing nothing but logging and leaving the current request stranded.
I also note that you aren't waiting for req.session.save() to complete before proceeding so you need to figure out if that is also something you need to do.