Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DynamoDB retrieve session does not check for expiration time #240

Closed
MauriceBrg opened this issue Apr 18, 2024 · 0 comments · Fixed by #237
Closed

DynamoDB retrieve session does not check for expiration time #240

MauriceBrg opened this issue Apr 18, 2024 · 0 comments · Fixed by #237

Comments

@MauriceBrg
Copy link
Contributor

MauriceBrg commented Apr 18, 2024

The DynamoDBSessionInterface relies on DynamoDB to expire outdated sessions through the TTL feature (unless they're explicitly deleted).
Unfortunately the TTL feature is asynchronous and can sometimes take several days to delete an item.

Items with valid, expired TTL attributes may be deleted by the system at any time, typically within a few days of their expiration. You can still update the expired items that are pending deletion, including changing or removing their TTL attributes. While updating an expired item, we recommended that you use a condition expression to make sure the item has not been subsequently deleted. — docs (emphasis mine)

That's why we should only request the item if its expiration time is after the current time.

This can be achieved using a ConditionExpression when calling get_item. (Isn't supported for GetItem)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging a pull request may close this issue.

1 participant