title: How to disallow TTL refresh for sessions stored through Express-session?
body: <p>I have a couple requirements around session handling and I'm having trouble enforcing one. </p>
  
  <p>Sessions need to:</p>
  
  <ol>
  <li>Expire in 30 mins if user has been inactive</li>
  <li>Expire in 8 hours from when user first logged on regardless of activity.</li>
  </ol>
  
  <p>I was able to configure item 1 but not item 2. Every time a user is browsing application, the cookie is updated (with time+30mins) and sent back to the browser but at the same time the session storage TTL is also refreshed. The last part is what I need to stop. </p>
  
  <p>I believe the TTL refresh is implemented as a feature from express-session. Session.touch() is called by the middleware but is there a setting that'll remove this action?</p>
  
  <p>The stack: 
  Node, express, express-session, connect-redis for session storage. </p>
  
  <p>The configuration:</p>
  
  <pre><code>    app.use(session({
    store: new RedisStore({
      client: redis_client,
      ttl: 28800 // 8 hours
    }),
    secret: config.redis_session_secret,
    resave: false,
    saveUninitialized: false,
    cookie: {
      path: '/',
      httpOnly: true,
      secure: false,
      maxAge: 30 * 60 * 1000 //mins * seconds * milliseconds. session cookie will expire every 30 mins 
    }, 
    rolling: true
  }));
  </code></pre>