Hi!

I was sure thet there is such an option but I couldn't find it. Maybe you could help me localise that functionality or maybe I am wrong and there is no such option.

Problem:

As an administrator I want to delete specific post revision from history:

Let's say that someone has written something confidential, edited hist posts. As long as other users have access to post history - confidential data has leaked. As an administrator / moderator I want to remove single post history revision (erase) so no one can read confidential data.

I was sure that I have done such a thing previously but couldn't find this functionality now.

Best regards,
cryptoethic

@cryptoethic I have banned the particular user and no more sessions are created.

I suggest adding method revokeSessionsAboveTreshold that removes oldest sessions above treshold.

	User.auth.addSession = async function (uid, sessionId) {
		if (!(parseInt(uid, 10) > 0)) {
			return;
		}
		await cleanExpiredSessions(uid);
                await revokeSessionsAboveTreshold(meta.config.maxUserSessions);
		await db.sortedSetAdd('uid:' + uid + ':sessions', Date.now(), sessionId);
	};

I can add such a function and add PR to core. What do you think?

@baris It looks worse - We receive a request every 1 second. It looks like this particular user has a bot that tries to login every 1 sec.

After 1 hour he has 3600 active sessions that are tried to be cleared on login.

Maybe we could add a limit for maximum active sessions

@baris Yep. Custom local-login passport strategy.

@baris

Doing some more console logs:

Every second cleanExpiredSessions for user (uid: 17445495) is called:

uuid mappings = Object.keys(uuidMapping).length

@cryptoethic

Ok so most queries comes from line 90:

@baris Yep we have some custom plugins. Traffic is mostly from registered users (90%).

Now we have below 1 page view / sec.

Creating sessions isn't anything bad I believe. It's just what is reading all of them

I will try to get the stacktrace of connect-redis

@baris
Thanks for fast answer.

Queries are not for one specific session but simultaneously for every session id (not sure if every but surely for many different ids and it looks like for every)

After switching to redis I also can see in redis-cli monitor:

It occurs every ~3 seconds now

Forum works fast now, but I'm worried that after some sessions will be created I will face the same issue.

Hi!

I'm facing a strange issue. My NodeBB server uses mongodb to store sessions. Every ~5 seconds there is a query for session. I checked, that method called is .get() from session storage (connect-mongo). It looks like this method is called for each session id.

During this peak there is a lag on a forum.

Is there any native express-session behavior that might cause so many requests?

I have checked that in NodeBB core there is only validateSession method that checks session, but I'm not receiving that many socket events.

Many thanks for your help
In the meantime I will remove all active sessions and try to store sessions in redis.

Best,
cryptoethic

Ok guys I have found the answer:

In prestart.js there is:

nconf.set('runJobs', nconf.get('isPrimary') && !nconf.get('jobsDisabled'));

And cronJobs are only run:

if (nconf.get('runJobs')) {
	require('./notifications').startJobs();
	require('./user').startJobs();
	require('./plugins').startJobs();
}

So it is well thought-out.

Hey guys!

What about cronJobs on multiple instances? Are they executing on every instance of nodebb or only on first for example?