express-session

const express = require('express'); const session = require('express-session'); const app = express(); const port = 3000; // WARNING: The default MemoryStore is NOT production-ready. // For production, use a compatible session store like connect-redis, connect-mongo, or memorystore. // For a list of stores, see compatible session stores section in the README. app.use(session({ secret: process.env.SESSION_SECRET ?? 'a very strong secret key that should be in an environment variable', // ALWAYS use a strong, environment-variable-backed secret resave: false, // Don't save session if unmodified saveUninitialized: true, // Save new but uninitialized sessions (e.g., before user logs in) cookie: { secure: process.env.NODE_ENV === 'production', // Use secure cookies in production (requires HTTPS) httpOnly: true, // Prevent client-side JavaScript access to cookie (mitigates XSS) maxAge: 24 * 60 * 60 * 1000 // Session expires after 24 hours (in milliseconds) } })); app.get('/', (req, res) => { if (req.session.views) { req.session.views++; res.send(`<h1>Welcome back!</h1><p>You have visited this page ${req.session.views} times.</p><p>Your session ID is: ${req.sessionID}</p>`); } else { req.session.views = 1; res.send(`<h1>Hello, New User!</h1><p>You have visited this page ${req.session.views} time.</p><p>Your session ID is: ${req.sessionID}</p>`); } }); app.listen(port, () => { console.log(`Server listening at http://localhost:${port}`); console.log('Try visiting a few times and then refresh after some time to see the session count.'); console.log('For production, ensure `secure: true` for cookies and that your app runs over HTTPS.'); });