help with multiple sessions

[stiff plume]

So I have admin users and normal users I would like a way so on the same browser a admin user and user can both have a session with different expires and stores. How would I go about doing this

[drifting locust]

that's no easy task
sessions cookies expires are pre set, you might be able to overwrite them based on admin or user, but that's all
this is something i usually would use jwt for even if i dont like them because you can set them after the user is logged in

with sessions you are going to need to pre set a expire date
then after the user is logged in check if they are are a admin and overwrite the expire
something like this

const hour = 3600000
const dynamicExpire === user.admin? new Date(Date.now() + (hour*2) : new Date(Date.now() + hour// admin cookies expire 1 hour later
req.session.cookie.expires = time

based on the express-session docs here
still idk why you would ever want this as if a admin session cookie would get compromised the attack have a full hour more then for a regular user
so for the sake of security i would suggest to not do this

[stiff plume]

Thank you for the nice helpful reply.

now would you suggest I just have it so once a user is logged in make them log out to log in as admin.

[mystic turtle]

Is the normal user being impersonated? Or is it an admin and that person should also have user permissions too?

[drifting locust]

Absolutely not, you make it unconventional for your admins
Nobody likes to login twice

[stiff plume]

OK so let me explain a little more maybe you guys can give me more insight lol.

So I have an adminUsers record an admin needs a email and password to login also has a role enum.

I also have a users record and they need to log in via username and password

An admin could also be a user at some point