// Login endpoint creates session app.post('/login', async (req: Request, res: Response) => { // ... password validation ... // 🎯 Session Creation req.session.userId = user.id; // Store user ID req.session.username = user.username; // Store username // Session cookie automatically sent to client });

app.use(session({ secret: 'your-secret-key-change-in-production', // 🔑 Signs session cookies resave: false, // Don't save unchanged sessions saveUninitialized: false, // Don't save empty sessions cookie: { secure: false, // Set true for HTTPS in production httpOnly: true, // 🛡️ Prevents XSS attacks maxAge: 24 * 60 * 60 * 1000 // ⏰ 24 hours timeout } }));

// Different timeout configurations maxAge: 30 * 60 * 1000, // 30 minutes maxAge: 2 * 60 * 60 * 1000, // 2 hours  maxAge: 24 * 60 * 60 * 1000, // 24 hours maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days

const requireAuth = (req: Request, res: Response, next: NextFunction) => { // 🔍 Session Verification if (req.session.userId) { next(); // ✅ Valid session - proceed } else { res.status(401).json({ error: 'Authentication required' }); // ❌ Invalid } }; // Apply to protected routes app.get('/dashboard', requireAuth, (req, res) => { // This only runs if session is valid });

app.use(session({ secret: 'your-secret-key-change-in-production', resave: false, saveUninitialized: false, rolling: true, // Add this line cookie: { secure: false, httpOnly: true, maxAge: 24 * 60 * 60 * 1000 // 24 hours } }) as express.RequestHandler);

const requireAuth = (req: Request, res: Response, next: NextFunction): void => { if (req.session.userId) { req.session.touch(); // This will save the session and renew the cookie next(); } else { res.status(401).json({ error: 'Authentication required' }); } };

app.post('/logout', (req, res) => { req.session.destroy((err) => { if (err) { return res.status(500).json({ error: 'Logout failed' }); } // 🗑️ Clear cookie from client res.clearCookie('connect.sid'); res.json({ message: 'Logout successful' }); }); });

// Current setup - sessions lost on server restart const users: User[] = []; // In-memory storage

import RedisStore from 'connect-redis'; import { createClient } from 'redis'; const redisClient = createClient(); redisClient.connect(); app.use(session({ store: new RedisStore({ client: redisClient }), // ... other options }));

import MongoStore from 'connect-mongo'; app.use(session({ store: MongoStore.create({ mongoUrl: 'mongodb://localhost:27017/sessions' }), // ... other options }));

import pgSession from 'connect-pg-simple'; const PostgreSQLStore = pgSession(session); app.use(session({ store: new PostgreSQLStore({ /* db config */ }), // ... other options }));

import FileStore from 'session-file-store'; const FileStoreSession = FileStore(session); app.use(session({ store: new FileStoreSession({ path: './sessions' }), // ... other options }));

jwt.sign(payload, secret, options)

const token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '1h' });

{ expiresIn: '1h' } // 1 hour { expiresIn: '30m' } // 30 minutes  { expiresIn: '7d' } // 7 days { expiresIn: '2y' } // 2 years

{ expiresIn: 3600 } // 3600 seconds = 1 hour

{ userId: 123, exp: Math.floor(Date.now() / 1000) + (60 * 60) // 1 hour from now }

try { const decoded = jwt.verify(token, JWT_SECRET) as any; req.userId = decoded.userId; } catch (error) { // Handle invalid/expired token }

jwt.verify(token, JWT_SECRET, { issuer: 'my-app', // Must match token's issuer audience: 'api-users', // Must match token's audience  algorithms: ['HS256'], // Only allow specific algorithms clockTolerance: 30, // Allow 30 seconds clock skew maxAge: '1h' // Additional age limit });

catch (error) { if (error instanceof jwt.TokenExpiredError) { // Token has expired } else if (error instanceof jwt.JsonWebTokenError) { // Invalid token format/signature } else if (error instanceof jwt.NotBeforeError) { // Token not active yet } }

// Use environment variables const JWT_SECRET = process.env.JWT_SECRET; // Generate secure random secret const crypto = require('crypto'); const secret = crypto.randomBytes(64).toString('hex');

// Good - minimal data { userId: 123, role: 'user' } // Bad - sensitive data { userId: 123, password: 'secret', creditCard: '1234' }

// Short access token const accessToken = jwt.sign( { userId: 123, type: 'access' }, JWT_SECRET, { expiresIn: '15m' } ); // Long refresh token  const refreshToken = jwt.sign( { userId: 123, type: 'refresh' }, JWT_SECRET, { expiresIn: '7d' } );

const token = jwt.sign( { userId: 123, email: 'user@example.com', role: 'admin' }, JWT_SECRET, { expiresIn: '1h', // Token expires in 1 hour issuer: 'my-application', // Who created this token audience: 'my-app-users', // Who can use this token subject: 'user-auth', // What this token is for algorithm: 'HS256', // Signing algorithm jwtid: 'unique-id-123' // Unique token identifier } );