🔐 Express Sessions

What Is a Session?

HTTP has no memory. Each request arrives as a stranger — the server has no built-in way to know that the person asking for /dashboard is the same person who logged in a moment ago. A session is how we give the server that memory.

This is the defining property of session-based auth: state lives on the server, and the client holds only an opaque identifier. Contrast that with a JWT, where the client carries the actual claims (user id, role, expiry) inside the token itself. We'll compare the two head-to-head later in the lesson.

How Session Auth Flows

Three parties collaborate on every authenticated request: the client (holding the cookie), the server (running your Express app), and the session store (where session data is persisted). Follow the ticket as it changes hands.

The key insight from this diagram: the cookie is looked up in the store on every request. That lookup is the session's superpower and its cost. The superpower is instant revocation — delete the row in the store and the user is logged out everywhere, immediately. The cost is that the store must be fast and shared across all your servers.

Setting Up express-session

The middleware does all the heavy lifting: it reads the incoming cookie, loads the matching session, exposes it as req.session, and writes any changes back to the store before the response goes out.

Install

npm install express express-session
// dotenv keeps secrets out of your source code:
npm install dotenv

A minimal, safe configuration

// app.js
require('dotenv').config();
const express = require('express');
const session = require('express-session');

const app = express();
app.use(express.json());

// Trust the first proxy so `secure` cookies work behind a load balancer/HTTPS terminator.
app.set('trust proxy', 1);

app.use(session({
  name: 'sid',                       // rename from the default 'connect.sid' to hide the stack
  secret: process.env.SESSION_SECRET, // signs the cookie — NEVER hard-code this
  resave: false,                     // don't re-save an unchanged session on every request
  saveUninitialized: false,          // don't create empty sessions for anonymous visitors
  cookie: {
    httpOnly: true,                                  // JavaScript can't read it (blocks XSS theft)
    secure: process.env.NODE_ENV === 'production',   // HTTPS-only in production
    sameSite: 'lax',                                 // sensible CSRF default
    maxAge: 1000 * 60 * 60                           // 1 hour, in milliseconds
  }
  // NOTE: no `store` here means the default MemoryStore — fine to learn on,
  // but replaced with Redis/Mongo before production (next lesson).
}));

app.get('/', (req, res) => {
  req.session.views = (req.session.views || 0) + 1;
  res.send(`You have visited this page ${req.session.views} time(s).`);
});

app.listen(3000, () => console.log('http://localhost:3000'));

You have visited this page 1 time(s).
You have visited this page 2 time(s).
You have visited this page 3 time(s).

That counter survives across requests because express-session restored req.session from the store using the ID in your cookie. Notice you never touched the cookie directly — you just read and wrote plain properties on req.session.

// Generate a strong secret once, then paste it into your .env file:
require('crypto').randomBytes(32).toString('hex');
// .env  ->  SESSION_SECRET=1f3c...e9a2  (64 hex chars)

The Configuration Options

Two options trip up nearly everyone: resave and saveUninitialized. Setting both to false is the modern default, and understanding why makes the rest click.

Login, Logout & Guards

Now the real thing. After you verify a password, you write the user's identity into the session; on protected routes you read it back; on logout you destroy it.

The login route

const bcrypt = require('bcrypt');
const User = require('../models/User');

router.post('/login', async (req, res) => {
  const { email, password } = req.body;

  const user = await User.findOne({ email });
  // Compare even the "no user" case to avoid leaking which emails exist (timing).
  const ok = user && await bcrypt.compare(password, user.passwordHash);
  if (!ok) {
    return res.status(401).json({ message: 'Invalid credentials' });
  }

  // Regenerate FIRST to get a fresh session ID (defeats fixation — see below),
  // THEN store the user identity in the new session.
  req.session.regenerate((err) => {
    if (err) return res.status(500).json({ message: 'Login failed' });

    req.session.userId = user._id.toString();
    req.session.role = user.role;

    // Persist before responding so the client's next request finds it.
    req.session.save((err) => {
      if (err) return res.status(500).json({ message: 'Login failed' });
      res.json({ message: 'Logged in', user: { id: user._id, email: user.email } });
    });
  });
});

An authentication guard

// middleware/auth.js
function isAuthenticated(req, res, next) {
  if (req.session && req.session.userId) return next();
  return res.status(401).json({ message: 'Authentication required' });
}

function requireRole(role) {
  return (req, res, next) => {
    if (req.session?.role === role) return next();
    return res.status(403).json({ message: 'Forbidden' });
  };
}

module.exports = { isAuthenticated, requireRole };

// Use the guard on any protected route:
const { isAuthenticated, requireRole } = require('./middleware/auth');

router.get('/profile', isAuthenticated, async (req, res) => {
  const user = await User.findById(req.session.userId).select('-passwordHash');
  res.json({ user });
});

router.get('/admin', isAuthenticated, requireRole('admin'), (req, res) => {
  res.json({ message: 'Welcome, admin' });
});

The logout route

router.post('/logout', (req, res) => {
  req.session.destroy((err) => {           // remove the session from the store
    if (err) return res.status(500).json({ message: 'Logout failed' });
    res.clearCookie('sid');                // tell the browser to drop the cookie
    res.json({ message: 'Logged out' });
  });
});

Regeneration & Session Fixation

A session fixation attack tricks a victim into using a session ID the attacker already knows. If the ID never changes when the victim logs in, the attacker's known ID becomes an authenticated one — and they're in.

The fix is one line, and you already saw it above: call req.session.regenerate() at login. It issues a brand-new random ID and discards the old one, so any ID the attacker planted is now worthless.

// The pattern: regenerate, then write identity into the FRESH session.
req.session.regenerate((err) => {
  if (err) return next(err);
  req.session.userId = user._id.toString();
  req.session.save(next);
});

Sessions vs. JWT: Choosing Deliberately

You've now used both models in this module. Neither is "better" — they trade different things.

Rule of thumb: if you can run a shared session store and want instant revocation, sessions are simpler and safer. If you're fanning out across many independent services, JWTs avoid the shared bottleneck. Many real apps use both — sessions for the web front end, short-lived JWTs for the API.

Practice & Quiz

app.get('/count', (req, res) => {
  req.session.count = (req.session.count || 0) + 1;
  res.json({ count: req.session.count });
});

app.post('/login', (req, res) => {
  req.session.regenerate((err) => {
    if (err) return res.status(500).json({ message: 'Login failed' });
    req.session.userId = 'demo-user';
    req.session.save(() => res.json({ message: 'Logged in' }));
  });
});

app.post('/logout', (req, res) => {
  req.session.destroy(() => {
    res.clearCookie('sid');
    res.json({ message: 'Logged out' });
  });
});

app.use(session({
  name: 'sid',
  secret: process.env.SESSION_SECRET,   // from the environment, strong & random
  resave: false,
  saveUninitialized: false,             // no session for anonymous visitors
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    maxAge: 1000 * 60 * 60
  }
}));

Best Practices & Pitfalls

✅ Do

• Load secret from process.env — long, random, and never committed
• Set resave: false and saveUninitialized: false
• Set cookie flags httpOnly, secure (in prod), and sameSite
• Call req.session.regenerate() on login and on privilege changes
• req.session.destroy() and res.clearCookie() on logout
• Swap the MemoryStore for a real store before production (next lesson)

❌ Don't

• Hard-code the session secret or ship 'keyboard cat'
• Store large or sensitive objects in the session — keep it to ids and flags
• Leave saveUninitialized: true and create empty sessions for every bot
• Forget app.set('trust proxy', 1) when behind HTTPS termination — secure cookies silently won't set

Summary

📚 Additional Resources

• Express — express-session middleware
• OWASP — Session Management Cheat Sheet
• MDN — HTTP cookies

🚀 What's Next?

Your sessions currently live in the default MemoryStore, which can't survive a restart or scale past one process. Next up: Session Stores — configuring Redis and MongoDB stores so your sessions are fast, persistent, and shared across every server.