Headers & Cookies
Request headers req.headers ya req.get("header-name") se milte hain (case-insensitive), aur response headers res.set() se set hote hain. Header HAMESHA body bhejne se PEHLE set karna padta hai.
res.cookie(name, value, options) Set-Cookie header bhejta hai. Security options important hain: httpOnly (JavaScript access rok deta hai, XSS se bachaav), secure (sirf HTTPS), aur sameSite (CSRF se bachaav). Incoming cookies padhne ke liye cookie-parser middleware chahiye.
app.use(require("cookie-parser")());
res.set("X-Request-Id", req.id);
res.cookie("token", jwt, {
httpOnly: true, secure: true, sameSite: "strict", maxAge: 86400000,
});
console.log(req.cookies.token); // cookie-parser ke baad- req.get() se request header padho, res.set() se response header set karo
- Headers body bhejne se PEHLE set karne padte hain
- Auth cookies par httpOnly + secure + sameSite lagana zaroori hai
req.get("content-type") case-insensitive hai, req.headers plain object deta hai. Response side par res.set() single ya multiple headers set kar sakta hai, aur res.type() sirf Content-Type ke liye shortcut hai. Sab headers body bhejne se PEHLE set hone chahiye.
const auth = req.get("Authorization");
res.set({ "X-Api-Version": "1.2", "Cache-Control": "no-store" });
res.type("json");httpOnly cookie ko JavaScript se padhne se rokta hai (XSS mein token churana mushkil), secure sirf HTTPS par bhejta hai, sameSite cross-site requests par cookie bhejne ko control karke CSRF se bachata hai, aur maxAge/expires lifetime set karte hain. Signed cookies tampering detect karti hain.
res.cookie("sid", id, {
httpOnly: true, secure: true, sameSite: "strict",
maxAge: 7 * 24 * 60 * 60 * 1000, signed: true,
});
res.clearCookie("sid");