I am new to express and using express-session to manage login(s) in my application. I have followed a blog and declared my session as below:-

app.use(session({
secret:'Keep It Secret',
name : 'uniqueSessionID',
resave : true,
saveUninitialized : true,
cookie : { secure : false, maxAge : 3600000, loggedIn : false, username : "" }
}));

The problem is that on a successful login I'm updating the session and printing it, which outputs to:-

    Session {
  cookie: {
    path: '/',
    _expires: 2021-12-27T13:16:17.355Z,
    originalMaxAge: 3600000,
    httpOnly: true,
    secure: false,
    loggedIn: true,
    username: '[email protected]'
  }
}

But after that when I authenticate the routes, the session remains unchanged just like below:-

    Session {
  cookie: {
    path: '/',
    _expires: 2021-12-27T13:16:17.355Z,
    originalMaxAge: 3600000,
    httpOnly: true,
    secure: false
  }
}

I have tried all and need help.

This is my login where I login and make the session:-

const login = (req, res, next) => {
console.log(req.body);
const email = req.body.email;
const password = req.body.password;

if(email == "" && password == ""){
    req.flash("message","please fill in the required fields");
    res.redirect("/admin/login");
}
else if(email == ""){
    req.flash("message", "please fill in the email");
    res.redirect("/admin/login");
}
else if(password == ""){
    req.flash("message", "please fill in the password");
    res.redirect("/admin/login");
}
else {
    user.findOne({email : email}, function(err, data){
        debugger;
        if(err){
            req.flash("message", "Username not found");
            res.redirect("/admin/login");
        }
        else {
            if(data.password == password){
                req.session.cookie.loggedIn = true;
                req.session.cookie.username = email;
                req.session.save(function(err) {
                    if (err) console.log(err);
                })
                console.log(req.session);
            }
            else{
                req.flash("message", "Invalid Password");
                res.redirect("/admin/login");
            }
            res.redirect("/admin/dashboard");
        }
    })
}

};

and This is my authentication function:-

exports.authenticated = (req, res, next) => {
debugger;
console.log(req.session);
if(req.session.cookie.loggedIn) {
    next();
}
else {
    res.redirect("/admin/login");
}
}

CodePudding user response：

It's incorrect to set the value, you want to save, to req.session.cookie it the place where you set up uniqueSessionID cookie options, not saved value.

See this tutorial for example

try

//to write
req.session.loggedIn = true;
req.session.username = email;

//to read
if(req.session.loggedIn) {
    next();
}

if all works, maybe you will want to make the session permanent between restarts, so see next Example with permanent storage