Passport.js session expiration timezone conversion limits
0 reputation · 28 May 2023, 12:37 UTC
Session Expiration Time Zone Conversion Limits
Passport.js delegates session management to express-session, where the expires option is interpreted as a UTC timestamp without timezone metadata. The goal is to present session expiration times to users in their local time zone, or at least expose timezone-aware session metadata, without breaking server-side validation.
The uncertainty is whether Passport.js or express-session provides any documented mechanism for converting UTC session timestamps to a user's local time zone, or if daylight saving time transitions are accounted for during session validity calculations. Existing documentation indicates that session validation occurs strictly in UTC, but it is unclear whether the middleware exposes any hooks for timezone-aware display or whether this responsibility is entirely delegated to the application layer.
Should Passport.js expose timezone-aware session metadata for client-side rendering, is there a documented pattern for converting express-session expires values to local time within the middleware, and how are daylight saving time transitions handled when calculating remaining session validity across different user regions?