feat: change default value of unset option from 'keep' to 'destroy'

HISTORY.md

@@ -1,6 +1,14 @@
 unreleased
 ==========
 
+## ⚠️ BREAKING CHANGES
+
+  * Change `unset` option default from `'keep'` to `'destroy'`
+    - Sessions unset via `req.session = null` (or `delete`) are now deleted from the store
+      when the response ends; pass `unset: 'keep'` to restore the previous behavior
+
+## Other changes
+
   * Replace `uid-safe` dependency with built-in `crypto.randomBytes` for session ID generation
     - Session IDs keep the same format as before (32-character base64url strings)
 

README.md

@@ -335,7 +335,7 @@ The session store instance, defaults to a new `MemoryStore` instance.
 Control the result of unsetting `req.session` (through `delete`, setting to `null`,
 etc.).
 
-The default value is `'keep'`.
+The default value is `'destroy'`.
 
   - `'destroy'` The session will be destroyed (deleted) when the response ends.
   - `'keep'` The session in the store will be kept, but modifications made during

index.js

@@ -119,8 +119,7 @@ function session(options) {
     throw new TypeError('unset option must be "destroy" or "keep"');
   }
 
-  // TODO: switch to "destroy" on next major
-  var unsetDestroy = opts.unset === 'destroy'
+  var unsetDestroy = opts.unset !== 'keep'
 
   if (Array.isArray(secrets) && secrets.length === 0) {
     throw new TypeError('secret option array must contain one or more strings');

test/session.js

@@ -1301,7 +1301,7 @@ describe('session()', function(){
       assert.throws(session.bind(null, { unset: 'bogus!' }), /unset.*must/)
     });
 
-    it('should default to keep', function(done){
+    it('should default to destroy', function(done){
       var store = new session.MemoryStore();
       var server = createServer({ store: store }, function (req, res) {
         req.session.count = req.session.count || 0
@@ -1324,7 +1324,7 @@ describe('session()', function(){
             if (err) return done(err);
             store.length(function(err, len){
               if (err) return done(err);
-              assert.strictEqual(len, 1)
+              assert.strictEqual(len, 0)
               done();
             });
           });