Support autoCommit=false for Next.js v12 compatibility

[yomed]

As of Next.js v12, there are console warnings when accessing res after getServerSideProps finishes. The warning looks like this:

warn - You should not access 'res' after getServerSideProps resolves.
Read more: https://nextjs.org/docs/messages/gssp-no-mutating-res

This appears to be due to the automatic committing of session changes within express-session here:

session/index.js

Lines 246 to 250 in 66634e9

	// proxy end() to commit the session
	var _end = res.end;
	var _write = res.write;
	var ended = false;
	res.end = function end(chunk, encoding) {

The library next-session uses a similar mechanism, but allows disabling it via option {autoCommit: false}:
https://github.com/hoangvvo/next-session/blob/b87f2cae77b321fb8960358cb3e85cfda9ecd701/src/session.ts#L119-L124

In the Next.js PR related to this change, they noted that this warning shouldn't break anything, but would prevent future adoption of streaming features. They suggested that libraries like express-session could support manual committing of session changes in order to avoid this issue:
vercel/next.js#29010 (comment)

Would you be open to this additional option?

[dougwilson]

This is already supported -- call req.session.save() when you want and then this library will not do it automatically at the end.

[yomed]

Hi @dougwilson, thanks for taking a look. I'm not too knowledgable about this, but from my own debugging it looks like even if the session doesn't need to be saved at the end, it will still get touched automatically at the end (which would lead to the same issue). I'm looking at this code:

session/index.js

Lines 344 to 354 in 66634e9

	} else if (storeImplementsTouch && shouldTouch(req)) {
	// store implements touch method
	debug('touching');
	store.touch(req.sessionID, req.session, function ontouch(err) {
	if (err) {
	defer(next, err);
	}
	debug('touched');
	writeend();
	});

session/index.js

Lines 453 to 461 in 66634e9

	function shouldTouch(req) {
	// cannot set cookie without a session ID
	if (typeof req.sessionID !== 'string') {
	debug('session ignored because of bogus req.sessionID %o', req.sessionID);
	return false;
	}
	return cookieId === req.sessionID && !shouldSave(req);
	}

[dougwilson]

Thanks. Perhaps you can provide a reproducable example of your issue (where that error/warning is printed)? If your session is fully saved at the end of the request, nothing should be touching the response unless there is a bug. Providing reproduction steps with code and how to run would be a big help.

[poacher2k]

Hey @dougwilson ! First off, thank you for the great library. I commented on the original nextjs-issue, and I'm still experiencing this.

Because of the line below, calling req.session.save() does not solve the issue of Next.js complaining, because this explicitly makes shouldSave false, ending up causing shouldTouch to be true.

session/index.js

Line 468 in 1aa756d

return cookieId === req.sessionID && !shouldSave(req);

Would it be possible to perhaps pass req.session.save a param to disable touching?