Persist sessions in Postgres instead of the express-session MemoryStore #34

New issue

Open

opened 2026-07-17 03:07:55 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-07-17 03:07:55 +00:00

Contributor

configureSession (backend/src/auth.js:9-19) uses express-session's default MemoryStore: unbounded growth, all sessions lost on every restart (each deploy logs the household out), and no path to a second replica. Add connect-pg-simple backed by the existing pool, with its table created via the normal migration flow (007_...), and set a sane cookie/session TTL. Verify login survives a backend restart behind Caddy.

Acceptance criteria

Sessions survive backend restart
Session table created by migration, not at runtime
Old sessions expire (TTL configured)

Relations: relates to #8

(Audit finding F-13, 2026-07-16 — Severity: Medium, Confidence: High)

`configureSession` (`backend/src/auth.js:9-19`) uses express-session's default MemoryStore: unbounded growth, all sessions lost on every restart (each deploy logs the household out), and no path to a second replica. Add `connect-pg-simple` backed by the existing pool, with its table created via the normal migration flow (`007_...`), and set a sane cookie/session TTL. Verify login survives a backend restart behind Caddy. **Acceptance criteria** - [ ] Sessions survive backend restart - [ ] Session table created by migration, not at runtime - [ ] Old sessions expire (TTL configured) **Relations:** relates to #8 *(Audit finding F-13, 2026-07-16 — Severity: Medium, Confidence: High)*

claude-bot added this to the v1.1.0 - Test & Ops Hardening milestone

2026-07-17 03:10:50 +00:00

claude-bot added the

ops

label

2026-07-17 03:11:49 +00:00