Add Session Management

Now you'll need to choose a session management client to store authentication tokens and user data for logged-in users. For more details on how session management works, view our Session Management documentation .

💡

Do you need session management?

Short answer: Yes.

While session management is technically optional, it's very strongly recommended for most applications. Only skip session management if your existing architecture makes implementation impractical.

Session Framework Options

This guide utilizes Iron Session for session management, but here's a comparison of popular Node.js session management options for reference:

Install Session Library

For this guide, use your package manager CLI to install Iron Session into your project.

npm install iron-session

yarn add iron-session

pnpm add iron-session

Configure Session Middleware

Configure Iron Session middleware to enable encrypted, cookie-based sessions (e.g. src/app.ts):

// app.ts
import { getIronSession } from 'iron-session';

...

// Initialize Iron Session middleware for cookie-based sessions.
app.use(async (req, res, next) => {
  req.session = await getIronSession(req, res, {
    cookieName: 'my-session-cookie-name',
    password: 'my-session-cookie-password', // 32-character minimum
    cookieOptions: {
      httpOnly: true,
      maxAge: 1800, // e.g. 30 minutes; Ideally, it should match your access token expiration.
      path: '/',
      sameSite: true, // May need to set this to 'Lax' if dealing with CORS in your environment
      secure: false, // IMPORTANT: set to true for production environments!!
    },
  });
  next();
});

...

Now the session for each authenticated user will be accessible on the req.session field throughout your Express routes and controllers.

Next, let's enhance the auth routes to add session management logic. We'll also introduce a new Session endpoint for loading session data into your frontend.