Sessions
Sessions keep users logged in by storing a session id in a cookie.
Syntax
app.use(session({ secret: '...' }))HTTP is stateless, so the server needs a way to remember a logged-in user across requests. Sessions do this: the server stores session data and gives the browser a cookie holding a session id.
The express-session middleware handles the cookie and storage for you. You attach data to req.session and it persists between requests.
Example
const session = require('express-session');
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
}));
app.post('/login', (req, res) => {
req.session.userId = 42;
res.send('Logged in');
});
app.get('/me', (req, res) => {
res.send('User: ' + req.session.userId);
});When to use it
- A traditional web app stores the logged-in user's ID in an Express session so every subsequent page request knows who is browsing.
- A shopping cart persists its contents across requests using express-session, letting users add items without logging in first.
- A developer uses express-session with a Redis store in production so sessions survive server restarts and work across multiple instances.
More examples
Basic session setup
Registers express-session, stores a userId on login, and reads it back on a protected route.
const session = require('express-session');
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
cookie: { httpOnly: true, maxAge: 3600000 },
}));
app.post('/login', (req, res) => {
req.session.userId = 42;
res.json({ loggedIn: true });
});
app.get('/me', (req, res) => {
if (!req.session.userId) return res.status(401).json({ error: 'Not logged in' });
res.json({ userId: req.session.userId });
});Session destroy on logout
Destroys the session server-side and clears the session cookie from the browser on logout.
app.post('/logout', (req, res) => {
req.session.destroy(err => {
if (err) return res.status(500).json({ error: 'Logout failed' });
res.clearCookie('connect.sid');
res.json({ loggedOut: true });
});
});Redis session store
Replaces the in-memory session store with Redis so sessions persist across restarts and scale horizontally.
const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');
const client = createClient({ url: process.env.REDIS_URL });
client.connect();
app.use(session({
store: new RedisStore({ client }),
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
}));
Discussion