Sessions & Cookie Auth
express-session server par session data rakhta hai aur client ko sirf EK session id cookie deta hai. JWT ke ulat, ye STATEFUL hai — isliye logout par session turant invalidate kiya ja sakta hai.
Default MemoryStore sirf development ke liye hai — server restart par sab sessions ud jaate hain aur multiple instances mein share nahi hote. Production mein Redis ya database-backed store use karo.
const session = require("express-session");
app.use(session({
store: new RedisStore({ client: redisClient }),
secret: process.env.SESSION_SECRET,
resave: false, saveUninitialized: false,
cookie: { httpOnly: true, secure: true, sameSite: "lax", maxAge: 864e5 },
}));
req.session.userId = user.id; // login
req.session.destroy(); // logout — turant invalid- Session stateful hai — data server par, client ke paas sirf session id
- Logout par session.destroy() turant access khatam kar deta hai
- MemoryStore production ke liye nahi — Redis/DB store use karo
Login par server session store mein entry banata hai aur client ko session id cookie bhejta hai. Har agli request par cookie aati hai, express-session store se data uthakar req.session bana deta hai. Data server par hai, isliye kabhi bhi turant invalidate kiya ja sakta hai.
app.post("/login", async (req, res) => {
const user = await auth(req.body);
req.session.regenerate(() => { // session fixation se bachaav
req.session.userId = user.id;
res.json({ ok: true });
});
});Session: revoke karna aasaan, cookie chhoti, lekin har request par store lookup aur shared store chahiye. JWT: stateless, microservices mein aasaan, lekin revoke karna mushkil aur token bada hota hai. Web app + single backend ke liye sessions aksar simpler hain, mobile/multi-service ke liye JWT.