mediumFrontend

How do you manage sessions and authentication in a Node.js web application?

Q: How do you manage sessions and authentication in a Node.js web application?

**TL;DR.** Authenticate the user (password+hash, OAuth, magic link), then maintain a **session**: either **server-side sessions** (a record in Redis keyed by a signed HttpOnly cookie) or **stateless tokens** (JWT). Protect cookies ( HttpOnly , Secure , SameSite ), guard against **CSRF** and **session fixation**, and authorize per request. login verify creds session id <text class='d-sub' x='247' y='89' text-anch

1.1k views

Understand the problem

This question assesses practical knowledge of common web development concerns with Node.js.

authenticationsessionsjwtsecurity

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Redis-backed sessions with secure cookies

import session from 'express-session';
import { RedisStore } from 'connect-redis';

app.use(session({
  store: new RedisStore({ client: redis }),
  secret: process.env.SESSION_SECRET,
  resave: false, saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax', maxAge: 86_400_000 },
}));

app.post('/login', async (req, res) => {
  if (!(await verify(req.body))) return res.status(401).end();
  req.session.regenerate(() => { req.session.userId = user.id; res.json({ ok: true }); });
});

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What are Worker Threads in Node.js and when would you use them?

What is the difference between spawn() and exec() in Node.js?