Sessions

Sessions store user state on the server, identified by a session ID stored in a cookie.

How Sessions Work

1. User logs in
   POST /login {username: "alice", password: "secret"}

2. Server creates session
   Session ID: abc123def456
   Store: {userId: 1, role: "admin", loginTime: "2024-01-15"}

3. Server sends session cookie
   Set-Cookie: session=abc123def456; HttpOnly; Secure; SameSite=Strict

4. Subsequent requests
   GET /dashboard
   Cookie: session=abc123def456

5. Server looks up session
   Find session abc123def456 → {userId: 1, role: "admin"}
   Use user data for request

Session Storage Options

Storage	Use Case	Persistence
Memory	Development only	Lost on restart
Database	Production	Persistent
Redis	High-performance	Persistent
Memcached	Distributed	Volatile

Express.js Session Example

const session = require('express-session');
const RedisStore = require('connect-redis').default;

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,     // HTTPS only
    httpOnly: true,   // No JS access
    maxAge: 3600000,  // 1 hour
    sameSite: 'strict'
  }
}));

// Login route
app.post('/login', async (req, res) => {
  const user = await authenticateUser(req.body);
  if (user) {
    req.session.userId = user.id;
    req.session.role = user.role;
    res.json({ success: true });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

// Protected route
app.get('/dashboard', (req, res) => {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  res.json({ userId: req.session.userId });
});

Proper session management is critical for security and user experience.

Session Lifecycle

Creation → Active → Idle → Expiry → Destruction

1. Creation: User logs in, session created
2. Active: User makes requests, session valid
3. Idle: No activity, timeout countdown
4. Expiry: Session expires, user must re-login
5. Destruction: User logs out, session destroyed

Session Timeout Strategies

// Absolute timeout (fixed duration from creation)
const ABSOLUTE_TIMEOUT = 24 * 60 * 60 * 1000; // 24 hours

// Idle timeout (inactivity based)
const IDLE_TIMEOUT = 30 * 60 * 1000; // 30 minutes

// Check session validity
app.use((req, res, next) => {
  if (req.session) {
    const now = Date.now();
    
    // Check absolute timeout
    if (now - req.session.createdAt > ABSOLUTE_TIMEOUT) {
      req.session.destroy();
      return res.status(401).json({ error: 'Session expired' });
    }
    
    // Check idle timeout
    if (now - req.session.lastActivity > IDLE_TIMEOUT) {
      req.session.destroy();
      return res.status(401).json({ error: 'Session expired' });
    }
    
    // Update last activity
    req.session.lastActivity = now;
  }
  next();
});

Session Security

Threat	Protection
Session Fixation	Regenerate ID on login
Session Hijacking	Secure, HttpOnly, SameSite flags
CSRF	SameSite attribute, CSRF tokens
Brute Force	Rate limiting, account lockout

// Regenerate session ID on login (prevent fixation)
app.post('/login', async (req, res) => {
  const user = await authenticateUser(req.body);
  if (user) {
    req.session.regenerate((err) => {
      req.session.userId = user.id;
      res.json({ success: true });
    });
  }
});

// Destroy session on logout
app.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    res.clearCookie('session');
    res.json({ success: true });
  });
});

Understanding when to use sessions vs cookies is essential for web development.

Comparison

Feature	Cookies	Sessions
Storage	Client (browser)	Server (database/Redis)
Size	~4KB	Unlimited
Security	Visible to client	Hidden from client
Lifetime	Configurable	Server-controlled
Performance	Sent with every request	Only session ID sent
Scaling	Easy (stateless)	Hard (stateful)

When to Use Each

Use Cookies For:

• Theme preferences
• Language settings
• Analytics tracking
• Non-sensitive preferences

Use Sessions For:

• User authentication
• Shopping cart contents
• Sensitive user data
• Temporary state

Hybrid Approach

// Store session ID in cookie, data on server
app.use(session({
  cookie: { maxAge: 3600000 },  // 1 hour
  store: new RedisStore({ client: redisClient })
}));

// Store preferences in cookie (lightweight)
res.cookie('theme', 'dark', { maxAge: 2592000000 }); // 30 days

// Store auth in session (secure)
req.session.userId = user.id;

JWT vs Sessions

Feature	Sessions	JWT
Storage	Server	Client
Revocation	Easy (delete from store)	Hard (need blacklist)
State	Server-side	Stateless
Scaling	Requires shared store	Scales easily

// Session approach
req.session.userId = user.id;
// Server checks session store on each request

// JWT approach
const token = jwt.sign({ userId: user.id }, secret);
// Client sends token, server verifies without lookup