Cookies and Sessions

npm install cookie-parser

const cookieParser = require('cookie-parser');
app.use(cookieParser());                         // unsigned
app.use(cookieParser('my-signing-secret'));      // enables signed cookies

// In a handler:
req.cookies.name;           // plain cookie
req.signedCookies.session;  // verified signed cookie (false if tampered)

// Simple
res.cookie('theme', 'dark');

// Secure, httpOnly session token
res.cookie('token', jwt, {
  httpOnly:  true,                    // not accessible from JS (prevents XSS theft)
  secure:    true,                    // HTTPS only
  sameSite:  'strict',               // 'strict' | 'lax' | 'none'
  maxAge:    7 * 24 * 60 * 60 * 1000, // ms; sets Expires too
  path:      '/',
  domain:    '.example.com',          // include subdomains
});

// Signed cookie (tamper-evident)
res.cookie('userId', '42', { signed: true });
// req.signedCookies.userId === '42' if not modified

res.clearCookie('token');
// Must pass same path/domain as when set, or browser won't clear it
res.clearCookie('token', { path: '/', domain: '.example.com' });

npm install express-session

const session = require('express-session');

app.use(session({
  secret:            process.env.SESSION_SECRET, // used to sign the session ID cookie
  resave:            false,     // don't save session if unmodified
  saveUninitialized: false,     // don't create session for unauthenticated requests
  name:              'sid',     // cookie name (default: 'connect.sid')
  cookie: {
    httpOnly:  true,
    secure:    process.env.NODE_ENV === 'production',
    sameSite:  'lax',
    maxAge:    24 * 60 * 60 * 1000, // 1 day
  },
}));

// Write to session
app.post('/login', (req, res) => {
  // validate credentials ...
  req.session.userId = user.id;
  req.session.role   = user.role;
  res.json({ ok: true });
});

// Read from session
app.get('/profile', (req, res) => {
  if (!req.session.userId) return res.status(401).json({ error: 'Not logged in' });
  res.json({ userId: req.session.userId });
});

// Destroy session on logout
app.post('/logout', (req, res, next) => {
  req.session.destroy((err) => {
    if (err) return next(err);
    res.clearCookie('sid');
    res.json({ ok: true });
  });
});

// Regenerate session ID (prevent session fixation after login)
app.post('/login', async (req, res, next) => {
  // ...validate...
  req.session.regenerate((err) => {
    if (err) return next(err);
    req.session.userId = user.id;
    res.json({ ok: true });
  });
});

// connect-pg-simple (PostgreSQL)
const pgSession = require('connect-pg-simple')(session);
app.use(session({
  store: new pgSession({ pool: pgPool, tableName: 'user_sessions' }),
  // ...
}));

// connect-redis (v8+, 2024 — named export; v7 was require('connect-redis').default)
const { RedisStore } = require('connect-redis');
const { createClient } = require('redis');
const client = createClient({ url: process.env.REDIS_URL });
await client.connect();
app.use(session({
  store: new RedisStore({ client }),
  // ...
}));

// connect-mongo
const MongoStore = require('connect-mongo');
app.use(session({
  store: MongoStore.create({ mongoUrl: process.env.MONGO_URL }),
  // ...
}));

const jwt = require('jsonwebtoken');
const KEY  = process.env.JWT_SECRET;

// Login — issue JWT
app.post('/login', async (req, res) => {
  const user = await validateCredentials(req.body);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  const token = jwt.sign({ sub: user.id, role: user.role }, KEY, { expiresIn: '7d' });
  res.cookie('token', token, {
    httpOnly: true,
    secure:   process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge:   7 * 24 * 60 * 60 * 1000,
  });
  res.json({ ok: true });
});

// Auth middleware
const authenticate = (req, res, next) => {
  const token = req.cookies.token
    || req.headers.authorization?.replace('Bearer ', '');

  if (!token) return res.status(401).json({ error: 'Unauthorized' });
  try {
    req.user = jwt.verify(token, KEY);
    next();
  } catch {
    res.clearCookie('token');
    res.status(401).json({ error: 'Invalid or expired token' });
  }
};

// Logout
app.post('/logout', (req, res) => {
  res.clearCookie('token', { path: '/' });
  res.json({ ok: true });
});

npm install connect-flash

const flash = require('connect-flash');
app.use(flash());

// Set a flash message
app.post('/login', (req, res) => {
  req.flash('error', 'Invalid credentials');
  res.redirect('/login');
});

// Read flash messages (consumed on read — gone after)
app.get('/login', (req, res) => {
  res.render('login', { errors: req.flash('error') });
});

// Synchronizer token pattern (with express-session)
app.use((req, res, next) => {
  if (!req.session.csrfToken) {
    req.session.csrfToken = require('crypto').randomBytes(32).toString('hex');
  }
  res.locals.csrfToken = req.session.csrfToken;
  next();
});

app.use((req, res, next) => {
  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();
  const token = req.body._csrf || req.headers['x-csrf-token'];
  if (token !== req.session.csrfToken) {
    return res.status(403).json({ error: 'Invalid CSRF token' });
  }
  next();
});