Cookies, Session Management & Security

🦁 Express.jsLesson 11Intermediate

Session identifiers stored inside encrypted cookies are standard features for handling stateful actions like logins. In Express, use the express-session module.

1 Configuring express-session middleware

JavaScript — session_setup.js

const session = require("express-session");

app.use(session({
  secret: "extremely-secret-key-change-this",
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: false, // Set to true if utilizing HTTPS
    httpOnly: true, // Safeguards cookie from client-side JS read
    maxAge: 3600000 // Session timeout in milliseconds (1 hour)
  }
}));

app.post("/login", (req, res) => {
  // Assign session properties upon verification
  req.session.userId = "user_12345";
  res.send("Logged in session successfully!");
});

2 Session Destroy and Logout

JavaScript — Logout flow

app.post("/logout", (req, res) => {
  req.session.destroy(err => {
    if (err) return res.status(500).send("Error logging out");
    res.clearCookie("connect.sid"); // clear default session cookie
    res.send("Logged out successfully");
  });
});

3 Code Challenge

Challenge: Write a route mapping GET requests to /dashboard. Ensure that the dashboard route only renders the data model if req.session.userId exists, returning a 403 Forbidden code if it does not.