Session-based auth with express-session - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of express-session in an Express app?

express-session helps keep track of user data across multiple requests by storing session info on the server. It allows the app to remember who the user is after they log in.

beginner

How does express-session identify a returning user?

It uses a cookie with a session ID stored in the user's browser. When the user sends requests, the cookie is sent back, letting the server find the matching session data.

intermediate

What is the role of the secret option in express-session?

The secret is a string used to sign the session ID cookie. This helps prevent tampering and keeps sessions secure.

intermediate

Why should session data be stored on the server and not in the cookie itself?

Storing session data on the server keeps sensitive info safe. Cookies can be seen or changed by users, so only a session ID is stored in the cookie to link to server data.

beginner

What happens when you call req.session.destroy() in an Express app?

This deletes the user's session data on the server and removes the session cookie, effectively logging the user out.

What does express-session use to track a user's session?

A A cookie storing a session ID

B Local storage in the browser

C A hidden form field

D URL query parameters

The session ID is stored in a cookie, which the browser sends with each request to identify the user session.

Which option is required when setting up express-session middleware?

A port number

B database URL

C secret

D view engine

The secret option signs the session ID cookie to secure it.

Where is session data stored when using express-session by default?

A In the user's cookie

B In a database automatically

C In the browser's local storage

D In memory on the server

By default, session data is stored in server memory, which is not suitable for production but fine for learning.

What does calling req.session.save() do?

A Saves changes to the session data immediately

B Deletes the session

C Creates a new session

D Logs the user out

This forces the session to be saved right away instead of waiting for the response to finish.

Why is it important to use HTTPS with sessions?

A To speed up the server

B To protect the session cookie from being stolen

C To allow more users to connect

D To enable cookies in the browser

HTTPS encrypts data sent between browser and server, protecting session cookies from attackers.

Explain how session-based authentication works using express-session in an Express app.

Think about how the server remembers who you are between page visits.

Describe the security benefits of using express-session with a secret and HTTPS.

Consider how to keep user info safe from attackers.