Secure Your Node.js Web Application

Set Up Sessions for Your Application

You can create sessions with query parameters, cookies, and tokens, to name just a handful of ways. We’ll start with the cookie-token-based sessions since they’re most commonly used.

Cookie-token sessions work by storing a token, also known as the sessionID, in the cookie. The application regularly uses the token to look up session information on the server side. Cookies are the preferred method for storing sessionIDs because they offer some control over the token’s lifespan. They’re also much more secure than using sessions based on the URL path.

Let’s set up a session using the express framework. Since the middleware uses cookies to store the sessionID, we need to use the cookieParser middleware ...