{"action":"closed","issue":{"url":"https://api.github.com/repos/expressjs/session/issues/533","repository_url":"https://api.github.com/repos/expressjs/session","labels_url":"https://api.github.com/repos/expressjs/session/issues/533/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/session/issues/533/comments","events_url":"https://api.github.com/repos/expressjs/session/issues/533/events","html_url":"https://github.com/expressjs/session/issues/533","id":283587145,"number":533,"title":"Reissue updated cookie when cookie domain setting changes","user":{"login":"bruun","id":422180,"avatar_url":"https://avatars3.githubusercontent.com/u/422180?v=4","gravatar_id":"","url":"https://api.github.com/users/bruun","html_url":"https://github.com/bruun","followers_url":"https://api.github.com/users/bruun/followers","following_url":"https://api.github.com/users/bruun/following{/other_user}","gists_url":"https://api.github.com/users/bruun/gists{/gist_id}","starred_url":"https://api.github.com/users/bruun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bruun/subscriptions","organizations_url":"https://api.github.com/users/bruun/orgs","repos_url":"https://api.github.com/users/bruun/repos","events_url":"https://api.github.com/users/bruun/events{/privacy}","received_events_url":"https://api.github.com/users/bruun/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-12-20T14:50:08Z","updated_at":"2017-12-21T18:52:26Z","closed_at":"2017-12-21T18:52:26Z","author_association":"NONE","body":"I have an application that has been issuing session cookies without the `domain` option set. Now I would like to add a `domain` option (for subdomain support), and then tell clients to remove  their old cookie and set a new cookie that contains the domain. \r\n\r\nThe only way I've been able to get around this is doing the following:\r\n1. Setting the `rolling` option to `true`\r\n2. Manually setting `request.session.cookie.domain` on every request.\r\n3. In my case: Manually set `Set-Cookie` with a `Expires` value in the past, in order for the old cookie to expire. Some browsers, such as Chrome, will keep both cookies as they are valid for several domains. This will make sure the old cookie is removed, and a new one is set with the new domain.\r\n\r\nThis approach feels like a hack, especially as I don't want to send a `Set-Cookie` header on every request. What I'd like to achieve is that the old cookie is unset _once_, and that the new cookie is set _once_ when the `domain` option has changed.\r\n\r\nIs there a better way to achieve what I want? "}}
{"actor":{"display_login":"bruun"}}