Express session, how do I get the session after posting? I see the session ID in browser under cooki-CodePudding

Sorry guys, I'm really new to sessions and cookies and I'm trying to understand the mechanism behind it. I wanted to add register/login to my simple website and in order to do I need to understand web authentication and I really think I will have tons of questions regarding this topic.

Initially, I have register page that sends info after clicking submit button to a node server using express. I'm trying to see what happens, so I've created a session in post route, it's created in the browser (connect.sid), then I commented out the part that creates that session and just tries to redisplay the session object, but it's undefined, but I still can see the session in the browser's cookies section, so what's going on? Thanks

app.use(session({
    secret:"my test secret",
    cookie:{},
    resave:false,
    saveUninitialized:false
}))

app.post("/register", (req, res) => {
    req.session.usertest = "testsession_hardcodedvaluefornow";
    console.log(req.session.usertest); // -> this is okay when above line to create is uncommented
       //but when I comment the session assignment, it becomes undefined?

    res.send("In register...");
})

I can see the session cookie even after commenting out the create session and posting over and over.

connect.sid s:_TahsTv0xhY-iHIdjDRblYJ_aZZ5oiSd.do7JcOGR1FaXPcFFIQ6hg5AW+0XVsYwIRO8vndyjDzs

req.session.id produces a different value (not undefined) even if I delete my session in the browser, so not sure where that comes from.

CodePudding user response：

There is no "usertest" key in the session object, therefore it is undefined. The reason it's not undefined when you uncomment that line is because you create that key yourself in that instant with that line.

You can get the whole session object by using req.session, the session id by using req.session.id and the session cookie by using req.session.cookie.

Edit

To further clarify: a session will be made for every connected client. That is why you can see the cookie in the browser. That has no meaning however, it's just a way to uniquely identify that client (without actually telling you who that client is). Any information about that session (whether they're logged in, user id,...) needs to be stored in a session store. Express-session will use memory store by default, if the server restarts all that information will be lost, which is why that key doesn't exist. In order to preserve that information it has to be stored in a persistent session store. More information on session store implementations for express-session and how to use them can be found here: https://www.npmjs.com/package/express-session

As for the cookie values you get, those are the default ones set by express-session since you haven't set any yourself. You can change the maxAge to let it expire (or set it so 10 years or more for a more persistent session), you can specify a domain to which that cookie belongs, you can set it to secure (to only allow it over secure connections, e.g. https) and httpOpnly is by default true. httpOnly cookies cannot be accessed/altered by the client (although you can see them in the browser), do not set this to false.