Add Session Middleware

To track logged-in users, add Wristband's session middleware to your app. It attaches a req.session object to every request. This securely saves user data in an encrypted cookie. On later requests, the middleware automatically decrypts the cookie to restore the user's state.

Configure Session Middleware

To enable session management, configure the Wristband SDK session middleware using createWristbandSession(). This requires a secret key of at least 32 characters to secure the session. You can generate a secure secret key at https://securepassword.dev.

📘
Disabling Secure Session Cookies in Local Development
By default, session cookies require HTTPS connections. Most browsers allow an exception for http://localhost. However, Safari enforces strict rules and blocks secure cookies on localhost. To bypass this for local development, set secure: false in your session options. Always restore secure: true in production to keep user data safe.

// src/wristband.ts

import { createWristbandAuth } from '@wristband/express-auth';
import { createWristbandSession } from '@wristband/express-auth/session';

export const wristbandAuth = createWristbandAuth({
  clientId: '<WRISTBAND_CLIENT_ID>',
  clientSecret: '<WRISTBAND_CLIENT_SECRET>',
  wristbandApplicationVanityDomain: '<WRISTBAND_APPLICATION_VANITY_DOMAIN>',
});

// NOTE: Session options can be used in both Session and Auth Middlewares.
const sessionOptions = {
  secrets: '<your-generated-secret>',
};

// Initialize the session middleware with your configured options.
export function wristbandSession() {
  return createWristbandSession(sessionOptions);
}

// src/wristband.ts

import { createWristbandAuth } from '@wristband/express-auth';
import { createWristbandSession } from '@wristband/express-auth/session';

export const wristbandAuth = createWristbandAuth({
  clientId: '<WRISTBAND_CLIENT_ID>',
  clientSecret: '<WRISTBAND_CLIENT_SECRET>',
  wristbandApplicationVanityDomain: '<WRISTBAND_APPLICATION_VANITY_DOMAIN>',
  dangerouslyDisableSecureCookies: true,
});

// NOTE: Session options can be used in both Session and Auth Middleware.
const sessionOptions = {
  secrets: '<your-generated-secret>',
  secure: false,
};

// Initialize the session middleware with your configured options.
export function wristbandSession() {
  return createWristbandSession(sessionOptions);
}

Register Session Middleware

Next, register the Wristband session middleware with your Express application.

// src/app.ts

import express from 'express';
import { wristbandSession } from './wristband';

const app = express();

// Register the session middleware to enable encrypted, cookie-based sessions.
app.use(wristbandSession());

// Your other application setup...

Configure Session Middleware

Disabling Secure Session Cookies in Local Development

Register Session Middleware

What’s Next