Session management and installation ids

I apologize if this topic has been discussed, or if I have simply missed something simple, but I’m needing help with understanding how _Sessions and _Installations work. If there is documentation somewhere that discusses these in-depth, please let me know where I can find them. I’ve looked in documentation and online, and I haven’t been able to find what I need.

My questions have arisen after getting the authentication set up on our website. I’m experiencing inconsistencies with the sessions created in Parse. I currently have the local session cookie expiring quickly in the browser, anywhere from minutes to a couple of hours while in development. The session token in Parse is getting set to expire in 3 years, which is fine for now.

Quick note, I’m developing in Next JS, and I’m doing all of my Parse account interaction on the server side, so I’m in a node server context. I’m not using the JS SDK on the client-side.

The problem is, there are times when I see multiple _Session objects for the account I’m testing with, and I don’t understand how it’s happening. If I wait for the session cookie to expire locally, then sign in while looking at the database in Parse Dashboard, the existing _Session object gets deleted and a new object is created immediately with a new expiration date. This all makes sense, and I figured that meant I would not need to run any custom session management code for Parse.

However, there are times when I open Parse Dashboard and see more than one _Session object for the account I’m developing with. I have confirmed the account is not in use by any other users or developers, so it’s not that someone else is creating the sessions. I have also confirmed the account is not being used in our app on any other devices, so no additional sessions are created that way either. I’m only using Chrome for my web development, so I’m not opening multiple browsers and signing in to the account. Also, I’m only using my one MacBook for development.

One other note, after writing this up, I tested to see what happens when I sign in to the app on my iPhone using the same account. After signing in to the account, a new _Session object was created, which made sense. I then deleted the app without signing out of my account, reinstalled, and signed in to the account again. After doing that, there was a new _Session object. So after doing this, there are two sessions for the same device, which I thought was not supposed to be possible. I figured the first _Session object would be deleted after the new sign in, and then a new one would get created, which didn’t happen.

How is it that multiple _Session objects are getting created? Is this normal functioning, and if so, is there a way I can make sure only one _Session object ever exists for each device signing in to the account?

One other question, which I believe is related to _Session objects, is how _Installations work. When I sign in to my account in Chrome, an _Installation object never gets created in Parse Dashboard even though there’s an “installationId” created on the _Session object. When I sign in on the iOS app, an _Installation object does get created. Do _Installation objects not get created when signing in to an account via a web browser?

Could this issue with the _Installations have something to do with signing in from a node server environment as opposed to in the browser client?

1 Like

This Is a topic i’d likes to clarify too.
In my case, web force users to logout from the front end After 15 minutes inactivity. When they login again, the old session object does not get deleted and a new One Is createsi, even when expired (and not Just invalid). Therefore now i havw 4000 session objects. Is there a reason for this to happen? I see no problem, since these session are all invalid anyway, buy yeah same…

I believe we have a ton of unused session tokens in our database as well. The problem is, in our case, these tokens are not invalid. Since these session tokens were created by the app, it’s not a security problem per se, as there’s no way to make use of them, but now that I’m building functionality on our site, the problem needs to be solved. I need to figure out what’s causing the extra session tokens to get created, then either fix whatever the problem is or simply create some type of manual token management.

Unfortunately, I’m still in a state right now where I don’t understand why they’re getting created.

I’m simply bumping this issue to the top of the forum in hopes that a Parse expert can help me understand the how the _Session and _Installation system works. I’m prepared to manage them more manually if needed, but I would prefer to have a better understanding of what’s actually happening behind the scenes before coding. Thank you in advance to anyone who can help.