Authentication - lesson 4 | HackIndia Skills

Authentication - lesson 4 | HackIndia Skills | HackIndia

Example

Express example

This example sets a session cookie after your login check has already passed. The value should be a random session id or a signed token created by your server.

In local development, Secure cookies may not work on plain http://localhost. Use an environment check, then make sure production uses HTTPS.

app.post('/login', async (req, res) => {
  // 1. Verify email and password first.
  // 2. Create a server-side session or signed token.
  const sessionId = await createSessionForUser(user.id);

  res.cookie('sid', sessionId, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    maxAge: 1000 * 60 * 60 * 24 * 7,
    path: '/'
  });

  res.json({ ok: true });
});

app.post('/logout', (req, res) => {
  res.clearCookie('sid', {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    path: '/'
  });

  res.json({ ok: true });
});

Use cookies safely

One rule

What flags do

Set safe defaults

Express example

Common mistake

Check in DevTools

CSRF note

Do this now

Quick check