.tip

Nov 12, 2025 · one of the small things

Kill sessions that sit idle inside a transaction

A connection that ran BEGIN and then went to lunch holds its locks and blocks vacuum from cleaning anything newer than its snapshot. You find out when the table bloats or a migration hangs.

ALTER SYSTEM SET idle_in_transaction_session_timeout = '60s';

Sixty seconds is generous for an app. The ORM that opens a transaction per request and forgets to commit on an error path is the usual culprit, and this setting is how you find it.

postgresqloperations

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close