need help with implementing rolling database-cookie sessions

[jovial raptor]

Hey folks here is my code to check if the session exists in the database I use it in my root loader

export async function getUserId(request: Request, { redirectTo }: { redirectTo?: string | null } = {}) {
  const { session: authSession, sessionId } = await getAuthSession(request);
  if (!sessionId) return null;
  const session = await db.session.findUnique({
    where: { id: sessionId, expiresAt: { gt: new Date() } },
    select: { userId: true },
  });
  if (!session?.userId) {
    const loginRedirect = getLoginRedirectURI(request, { redirectTo });
    throw redirect(loginRedirect, {
      headers: {
        "Set-Cookie": await authSessionStorage.destroySession(authSession),
      },
    });
  }
  return { userId: session.userId };
}

currently my app has an absolute session expiration of 30 days I want to add rolling session in my app so after last time session was updated if 15 days have passed then session will renew for another 30 days so to implement rolling session here is what I'm thinking to do when getting the session from the database also get when it was last time updated after checking session exist I will check if updatedAt + 15 days <= now() if it result in true I will extend the session for another 30days but now this time along with userId I will also return a new property updated: true now in my root loader I can check if the returned data has updated property if it has then I will update the auth session storage cookie also is this rolling session approach good because according to sergio article regarding rolling session loader is not good place for rolling session instead we should use entry.server file but that article only assumes purely cookie session where mine is database-cookie session

[jovial raptor]

Hey @modern oak can you help me sorry for pinging you

[radiant spoke]

Yeah, don’t do that. We strongly discourage sending @s to individual users for generic questions.

Sergio is probably in bed anyway 😅

[jovial raptor]

yeah, I also think his is in bed right also I didn't want to ping him but there was no reply to my question for more than 12 hours so I think I should mention sergio as he has written an article already on rolling session

so I thnked that he might be the best person to ask about this

[modern oak]

A middleware is the best place IMO https://github.com/sergiodxa/remix-utils#session-middleware

But entry.server is the second best, as you can ensure it happens once per request

[jovial raptor]

but this is for purely cookie based session how does it play with database-cookie session where you first update the session in database and then in cookie

one more question does this article of you which was for older version of remix still hold up for react-router v7
https://sergiodxa.com/tutorials/use-tanstack-query-to-share-data-between-remix-loaders

[modern oak]

instead of parsing and re-serializing the cookie, use getSession and commitSession

[modern oak]

no, at some point TanStack Query stopped batching requests, I built and use https://github.com/edgefirst-dev/batcher myself

[jovial raptor]

yeah because when I also tried implement that in my app still two different request were made

[jovial raptor]

if you don't mind can you give an example of this where actual session is stored in database and it's identifier is stored in cookie

[modern oak]

Kent's EpicStack does that, you can check the code there

but you can also use createSessionStorage to implement a custom session storage helper that uses your DB

[jovial raptor]

you got my question wrong I know that in epic-stack session is stored in database while the identifier is stored in cookie that's how every auth framework does what I want is implement the rolling session what I want to do is get the session id from cookie check if session exist in the database if yes then get the userId along with the time it was last updated the I would check if specific time period from last updated is passed or not if it passed the update the session in database and then in cookie this is what I want to do your article assumes purely cookie based session so I'm having hard time implementing this I thought of way to do that which I mentioned in my original post but I don't know if it's the correct way or not or it needs any improvement

[modern oak]

// use a custom DB-backed session storage to read the session
let session = await sessionStorage.getSession(request.headers.get("cookie")
session.set("expiresAt", newExpiresAt) // set the new expiration on the session data
let header = await sessionStorage.commitSession(session) // commit the session
heaaders.append("set-cookie", header) // add a set-cookie header so you also extend the live of the session cookie and not only the session in the DB