Express.js not saving session data

Question

I am building a web app and I would like to assign every client a random user ID (which should be retained across sessions). For this, I am setting the userId session variable.

const app = express()
app.use(session({
    secret: '1234',
    resave: true,
    saveUninitialized: true,
}))
app.use(cors())
app.use(express.json())
app.use(express.urlencoded())
app.use(express.static("public"))

app.get("/", (req, res) => {
    req.session.userId = "user-" + utils.generateRandomString()
    res.sendFile(__dirname + '/index.html')
})

app.post("/api/auth", (req, res) => {
    console.log(req.session)
    // auth logic
    res.send("Success")
})

So when the user navigates to /, the userId is set. This userId should be sent with the next request, to /api/auth, But the userId session variable is always undefined. This is what the console.log call prints:

Session {
  cookie: { path: '/', _expires: null, originalMaxAge: null, httpOnly: true }
}

Edit: here is the minimal client code that results in the problem:

fetch("/api/auth", {
    method: "POST",
    body: ""
}).then(res => res.text().then(text => console.log(text)))

I tried changing the order of the session middleware (placing it after cors, json, urlencoded and static) but to no avail.

So, how do I get around this?

This could be a client problem. What is making the 2nd request? Is it an Ajax call via Javascript? If so, it has to have the right settings so that it will send the session cookie. If it doesn't send the session cookie, then the next call will just make a new, empty session. Please show the relevant client code making this request. — jfriend00
– jfriend00, Commented Nov 12, 2023 at 5:30
Yes, it is an AJAX call. But the session cookie (connect.sid) is included in the request, and I can see it in the browser's dev tools. The problem is probably in the server - it is not able to find the session with the given session ID. — Wais Kamal
– Wais Kamal, Commented Nov 12, 2023 at 6:24
Please show the relevant client code. I see nothing wrong with the server code. — jfriend00
– jfriend00, Commented Nov 12, 2023 at 6:28
You need the credentials: 'include' option with your fetch() so it will send the session cookie. See stackoverflow.com/questions/50698444/…. — jfriend00
– jfriend00, Commented Nov 12, 2023 at 6:44

jfriend00 · Accepted Answer · 2023-11-14 05:40:36Z

1

To close out this question with the answer, you can change this:

app.use(express.static("public"));

to this:

app.use(express.static("public"), {index: false});

The problem was that express.static() was "stealing" the / route (because it found an index.html file in its directory and thus the route handler that was supposed to run for that route and then execute this line of code was never being executed:

req.session.userId = "user-" + utils.generateRandomString()

So, it wasn't an issue of losing the cookie or the session. It was an issue of the desired route handler was never executing so the userId value was never set in the session in the first place.

answered Nov 14, 2023 at 5:40

jfriend00

711k104 gold badges1.1k silver badges1k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Express.js not saving session data

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related