set expire in cookie value

ensure every session will expire

index.js

@@ -3,6 +3,7 @@
  */
 
 var debug = require('debug')('koa-session');
+var deepEqual = require('deep-equal');
 
 /**
  * Initialize session middleware with `opts`:
@@ -46,7 +47,8 @@ module.exports = function(opts){
       if (json) {
         debug('parse %s', json);
         try {
-          sess = new Session(this, decode(json));
+          json = decode(json);
+          sess = new Session(this, json);
         } catch (err) {
           // backwards compatibility:
           // create a new session if parsing fails.
@@ -153,8 +155,7 @@ Session.prototype.toJSON = function(){
 
 Session.prototype.changed = function(prev){
   if (!prev) return true;
-  this._json = encode(this);
-  return this._json != prev;
+  return !deepEqual(prev, this.toJSON());
 };
 
 /**
@@ -189,10 +190,15 @@ Session.prototype.__defineGetter__('populated', function(){
 
 Session.prototype.save = function(){
   var ctx = this._ctx;
-  var json = this._json || encode(this);
+  var json = this.toJSON();
   var opts = ctx.sessionOptions;
   var key = ctx.sessionKey;
 
+  // set expire into cookie value
+  var maxAge = opts.maxAge || opts.maxage || 24 * 60 * 60 * 1000; // default 1d
+  json._expire = maxAge + Date.now();
+
+  json = encode(json);
   debug('save %s', json);
   ctx.cookies.set(key, json, opts);
 };
@@ -207,7 +213,13 @@ Session.prototype.save = function(){
 
 function decode(string) {
   var body = new Buffer(string, 'base64').toString('utf8');
-  return JSON.parse(body);
+  var json = JSON.parse(body);
+
+  // check if the cookie is expired
+  if (!json._expire) return null;
+  if (json._expire < Date.now()) return null;
+  delete json._expire;
+  return json;
 }
 
 /**
@@ -221,4 +233,4 @@ function decode(string) {
 function encode(body) {
   body = JSON.stringify(body);
   return new Buffer(body).toString('base64');
-}
+}

package.json

@@ -21,7 +21,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "debug": "*"
+    "debug": "*",
+    "deep-equal": "~0.2.1"
   },
   "scripts": {
     "test": "NODE_ENV=test mocha --harmony-generators --require should --reporter spec",

test/test.js

@@ -335,6 +335,73 @@ describe('Koa Session', function(){
       .expect(401, done);
     })
   })
+
+  describe('when maxAge present', function () {
+    describe('and not expire', function () {
+      it('should not expire the session', function (done) {
+        var app = App({ maxAge: 100 });
+
+        app.use(function* () {
+          if (this.method === 'POST') {
+            this.session.message = 'hi';
+            this.body = 200;
+            return;
+          }
+
+          this.body = this.session.message;
+        });
+
+        var server = app.listen();
+
+        request(server)
+        .post('/')
+        .expect('Set-Cookie', /koa:sess/)
+        .end(function (err, res) {
+          if (err) return done(err);
+          var cookie = res.headers['set-cookie'].join(';');
+
+          request(server)
+          .get('/')
+          .set('cookie', cookie)
+          .expect('hi', done);
+        })
+      })
+    })
+
+
+    describe('and expired', function () {
+      it('should expire the sess', function (done) {
+        var app = App({ maxAge: 100 });
+
+        app.use(function* () {
+          if (this.method === 'POST') {
+            this.session.message = 'hi';
+            this.status = 200;
+            return;
+          }
+
+          this.body = this.session.message || '';
+        });
+
+        var server = app.listen();
+
+        request(server)
+        .post('/')
+        .expect('Set-Cookie', /koa:sess/)
+        .end(function (err, res) {
+          if (err) return done(err);
+          var cookie = res.headers['set-cookie'].join(';');
+
+          setTimeout(function () {
+          request(server)
+          .get('/')
+          .set('cookie', cookie)
+          .expect('', done);
+          }, 200);
+        })
+      })
+    })
+  })
 })
 
 function App(options) {