Cookies and Sessions

Lesson content

🎯 Goal By the end of this lesson, you'll understand: What are Cookies? What are Sessions? Difference between Cookies and Sessions How they work Express.js examples Real-world examples Interview questions What are Cookies? A Cookie is a small piece of data stored in the user's browser . The browser automatically sends the cookie with every request to the same website. Simple Definition: A Cookie stores small amounts of data in the user's browser. Why Do We Need Cookies? Cookies are used for: Login Remember Me User Preferences Language Settings Theme (Dark/Light Mode) Tracking User Sessions Real-Life Example 🍪 Imagine visiting a hotel. Guest Checks In │ ▼ Hotel Gives Room Card │ ▼ Guest Shows Card Every Time Room Card = Cookie Guest = Browser Hotel = Server What is a Session? A Session stores user information on the server . The browser stores only a Session ID in a cookie. Simple Definition: A Session stores user data on the server, while the browser stores only the Session ID. Why Do We Need Sessions? Sessions are used for: User Login Shopping Cart Banking Applications Online Exams User Authentication Real-Life Example 🏦 Bank Visit Customer Logs In │ ▼ Server Creates Session │ ▼ Session ID Sent to Browser │ ▼ Browser Sends Session ID │ ▼ Server Identifies User Cookies vs Sessions Feature Cookies Sessions Storage Browser Server Size About 4 KB Depends on server Security Less secure More secure Lifetime Configurable Until session expires or is destroyed Stores Small data User information How Cookies Work Browser │ ▼ Login Request │ ▼ Server │ Set Cookie │ ▼ Browser Stores Cookie │ ▼ Next Request │ Cookie Sent Automatically How Sessions Work Browser │ ▼ Login Request │ ▼ Server Creates Session │ ▼ Session ID Cookie │ ▼ Browser Stores Session ID │ ▼ Next Request │ Session ID Sent │ ▼ Server Finds Session Data Install Packages npm install express-session cookie-parser Cookie Example const express = require ( "express" ); const cookieParser = require ( "cookie-parser" ); const app = express (); app . use( cookieParser ()); app . get( "/" , ( req , res ) => { res . cookie( "username" , "Ajay" ); res . send( "Cookie Created" ); }); app . listen( 3000 ); Read Cookie app . get( "/profile" , ( req , res ) => { console . log( req . cookies . username); res . send( "Profile" ); }); Delete Cookie app . get( "/logout" , ( req , res ) => { res . clearCookie( "username" ); res . send( "Cookie Deleted" ); }); Session Example const express = require ( "express" ); const session = require ( "express-session" ); const app = express (); app . use( session ({ secret: "mySecretKey" , resave: false , saveUninitialized: false })); app . get( "/" , ( req , res ) => { req . session . username = "Ajay" ; res . send( "Session Created" ); }); app . listen( 3000 ); Read Session app . get( "/profile" , ( req , res ) => { res . send( req . session . username); }); Destroy Session app . get( "/logout" , ( req , res ) => { req . session . destroy(() => { res . send( "Session Destroyed" ); }); }); Authentication Flow User Login │ ▼ Server Verifies User │ ▼ Session Created │ ▼ Session ID Stored in Cookie │ ▼ Browser Sends Session ID │ ▼ User Authenticated Cookies vs JWT vs Sessions Feature Cookies Sessions JWT Data Stored Browser Server Browser/Client Server Storage ❌ No ✅ Yes ❌ No Best For Preferences Traditional Login REST APIs Real-Life Example 🛒 Shopping Website User Login │ ▼ Session Created │ ▼ Add Products │ ▼ Checkout │ ▼ Logout The session keeps track of the logged-in user during the visit. Security Best Practices ✅ Use HTTPS to protect cookies. ✅ Set cookies with httpOnly: true to prevent JavaScript access. res . cookie( "token" , "abc123" , { httpOnly: true }); ✅ Use secure: true in production (HTTPS only). secure : true ✅ Set sameSite ( "lax" or "strict" ) to reduce CSRF risk. sameSite : "lax" ✅ Use a strong secret for express-session . ❌ Don't store passwords or other sensitive information directly in cookies. Interview Question Where are Cookies stored? Answer In the Browser Where are Sessions stored? Answer On the Server What is stored in the browser when using Sessions? Answer Session ID Best Practices ✅ Use cookies for small client-side data like preferences. ✅ Use sessions for traditional server-side authentication. ✅ Set httpOnly , secure , and sameSite on authentication cookies. ✅ Destroy the session when the user logs out. ❌ Don't store sensitive user information directly in cookies. Key Points ✅ Cookies store small amounts of data in the browser. ✅ Sessions store user data on the server. ✅ The browser usually stores only the Session ID when using sessions. ✅ Cookies are suitable for preferences and lightweight data. ✅ Sessions are commonly used for login and authentication. ✅ Secure cookie settings ( httpOnly , secure , sameSite ) are important for protecting users. 🧠 Easy Formula Need Small Browser Data? │ ▼ Cookie Need User Login? │ ▼ Session Cookie = Browser Storage Session = Server Storage Browser ↓ Session ID Server ↓ User Data Remember: 🍪 Cookie = Small data stored in the browser 🗂️ Session = User data stored on the server 🔑 Browser stores only the Session ID 🔒 Use secure cookie options ( httpOnly , secure , sameSite ) for authentication