express-session
Advanced tools
Package description
The express-session npm package is a middleware for Express applications that enables server-side session management. It allows you to store and access user data as they interact with your web application. The package creates a session ID for each client and uses it to store data across multiple HTTP requests.
Session Initialization
This code initializes the express-session middleware with a secret to sign the session ID cookie, and configuration options such as 'resave', 'saveUninitialized', and 'cookie' settings.
const express = require('express');
const session = require('express-session');
const app = express();
app.use(session({
secret: 'keyboard cat',
resave: false,
saveUninitialized: true,
cookie: { secure: true }
}));Storing Session Data
This code demonstrates how to store data in the session object. The value 'This is saved in session' is stored under the key 'myValue' in the session.
app.use(session({ /* ... */ }));
app.get('/save', function(req, res) {
// Save a value to the session
req.session.myValue = 'This is saved in session';
res.send('Session value stored.');
});Retrieving Session Data
This code shows how to retrieve data from the session. It accesses the value stored under the key 'myValue' and sends it in the HTTP response.
app.get('/retrieve', function(req, res) {
// Retrieve a value from the session
const myValue = req.session.myValue;
res.send(`Session value: ${myValue}`);
});Destroying a Session
This code provides an example of how to destroy a session, effectively logging out the user. It handles any errors that might occur during the destruction process.
app.get('/logout', function(req, res) {
// Destroy the session
req.session.destroy(function(err) {
if(err) {
return res.send('Error destroying session');
}
res.send('Session destroyed');
});
});The cookie-session package is similar to express-session but stores the session data directly in a cookie on the client-side, rather than on the server. This can be simpler and more scalable for some applications, but it is less secure and has limitations on the amount of data you can store.
Connect-redis is a Redis session store for the express-session package. It requires express-session to be installed and configured, but it uses Redis to store session data, which can be more performant and scalable for applications with a high number of sessions.
Connect-mongo is a MongoDB session store for the express-session package. Similar to connect-redis, it leverages MongoDB to store session data, providing a scalable and performant solution for managing sessions in Express applications.
Readme
Setup session store with the given options.
Session data is not saved in the cookie itself, however
cookies are used, so we must use the cookieParser()
middleware before session().
app.use(connect.cookieParser())
app.use(connect.session({ secret: 'keyboard cat', key: 'sid', cookie: { secure: true }}))
Options
key cookie name defaulting to connect.sidstore session store instancesecret session cookie is signed with this secret to prevent tamperingcookie session cookie settings, defaulting to { path: '/', httpOnly: true, maxAge: null }proxy trust the reverse proxy when setting secure cookies (via "x-forwarded-proto")Cookie options
By default cookie.maxAge is null, meaning no "expires" parameter is set
so the cookie becomes a browser-session cookie. When the user closes the
browser the cookie (and session) will be removed.
To store or access session data, simply use the request property req.session,
which is (generally) serialized as JSON by the store, so nested objects
are typically fine. For example below is a user-specific view counter:
app.use(cookieParser())
app.use(session({ secret: 'keyboard cat', cookie: { maxAge: 60000 }}))
app.use(function(req, res, next){
var sess = req.session;
if (sess.views) {
res.setHeader('Content-Type', 'text/html');
res.write('<p>views: ' + sess.views + '</p>');
res.write('<p>expires in: ' + (sess.cookie.maxAge / 1000) + 's</p>');
res.end();
sess.views++;
} else {
sess.views = 1;
res.end('welcome to the session demo. refresh!');
}
})
To regenerate the session simply invoke the method, once complete
a new SID and Session instance will be initialized at req.session.
req.session.regenerate(function(err){
// will have a new session here
});
Destroys the session, removing req.session, will be re-generated next request.
req.session.destroy(function(err){
// cannot access session here
});
Reloads the session data.
req.session.reload(function(err){
// session updated
});
Save the session.
req.session.save(function(err){
// session saved
});
Updates the .maxAge property. Typically this is
not necessary to call, as the session middleware does this for you.
Each session has a unique cookie object accompany it. This allows
you to alter the session cookie per visitor. For example we can
set req.session.cookie.expires to false to enable the cookie
to remain for only the duration of the user-agent.
Alternatively req.session.cookie.maxAge will return the time
remaining in milliseconds, which we may also re-assign a new value
to adjust the .expires property appropriately. The following
are essentially equivalent
var hour = 3600000;
req.session.cookie.expires = new Date(Date.now() + hour);
req.session.cookie.maxAge = hour;
For example when maxAge is set to 60000 (one minute), and 30 seconds
has elapsed it will return 30000 until the current request has completed,
at which time req.session.touch() is called to reset req.session.maxAge
to its original value.
req.session.cookie.maxAge;
// => 30000
Every session store must implement the following methods
.get(sid, callback).set(sid, session, callback).destroy(sid, callback)Recommended methods include, but are not limited to:
.length(callback).clear(callback)FAQs
Simple session middleware for Express
The npm package express-session receives a total of 1,606,927 weekly downloads. As such, express-session popularity was classified as popular.
We found that express-session demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Researchers recently demonstrated that the npm Registry is vulnerable to cache poisoning combined with DoS, posing significant risks for package availability.
Security News
The June TC39 meeting wrapped up this week with eight proposals moving on to the next stage. Here's a quick roundup of the features that the committee approved to advance.
Security News
Cyber extortion in the US and Canada hit record levels in 2023, with ransomware attacks surging and median ransom demands skyrocketing, though fewer companies are choosing to pay ransoms.