Sessions and cookies

HTTP has no memory

HTTP is stateless: each request stands alone, and the server does not remember the one before. So after you log in, something must remind the server on every later request that you are you. The classic answer is a session.

A session is a small record on the server, such as { userId: 42, expiresAt: ... }, saved under a long random id. A cookie is a small piece of text the server asks the browser to store and send back automatically with every request to that site.

A login, step by step

1. The user sends email and password to POST /api/login.
2. The server checks the password hash.
3. It creates a session with a new random id and saves it in the session store.
4. It replies with a Set-Cookie header holding the session id.
5. The browser sends Cookie: sid=... with every later request.
6. The server finds the session by id and knows the user.

HTTP/1.1 200 OK
Set-Cookie: sid=9f2c4e7a1b...; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax

--- next request from the browser ---
GET /api/orders HTTP/1.1
Cookie: sid=9f2c4e7a1b...

Where to keep sessions

Cookie flags that keep sessions safe

// Example only: runs on a server with Node.js and Express
res.cookie('sid', sessionId, {
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
  maxAge: 24 * 60 * 60 * 1000, // Express takes milliseconds here
  path: '/',
});

Logout, expiry and session fixation

Logout must delete the session on the server, not just the cookie in the browser; otherwise a copied session id still works. Also give sessions an idle timeout (for example 30 minutes for a bank) and an absolute limit (for example 7 days).

Session fixation is an attack where someone plants a session id they know in your browser before you log in. If the server keeps the same id after login, the attacker is now logged in as you. The fix is simple: always create a brand-new session id at login (in Express: req.session.regenerate).