How do server side authentication sessions work (express & cookies)

A walkthrough on how server side authentication sessions work using cookies.
------------
🔔 Newsletter eepurl.com/hnderP
💬 Discord / discord
📁. GitHub github.com/cod...

[@aissa.bouguern]

I really like how you explained sessions without relying on "express-session" or any third-party library that abstracts the work done behind the scenes. This helps beginners to adopt a nice and very simple mental model about what sessions are about. Thank you so much!

[@mossabDiae]

Cody, that was beautifully explained. The note you added at the end about why JWT would be useful is a gem. Subscribed.

[@Goofy8907]

DUDE, this is how you explain something Very well done, I just came from another video on the same topic, watched the whole thing and was still clueless. Watched your video for like 3 minutes and had most of my questions answered, kept watching because of how well you explained. Thank you, I'm subscribing.

[@SkySentry7]

TYSM man. I've been struggling trying to understand how sessions work with cookies

[@JoelGrayson]

Thank you for the simple explanation. Helped me a lot. Tip: res.clearCookie() does the same thing as res.set('Set-Cookie', `session=null`)

[@bitsplode]

whats the difference? Number one wipes the cookie out of existance and number 2 just null-ifies it???

[@jperusm]

@@bitsplode that is correct. number two will just "modify" the cookie value but will not delete it.

[@meepk633]

I learned today that you can use the 'public' and 'private' keywords in TypeScript constructor parameters to auto-assign them. You don't even need to list them as members. It just adds them to the instance automatically. This is completely unrelated btw. Just wanted to share.

[@cristianadejola464]

Currently working same subject but with SQL database. Bit complicated and stressful. But your tutorial help a lot. Thanks ones again

[@devnarula6733]

exactly what I was looking for, appreciate such low level bare-bone session auth for understanding instead of just using some plugin which teaches no one anything!

[@HassanChakkour]

You sir deserve all the support, thank you so much, you pretty much saved me time. Great work

[@marksheard1210]

Awesome stuff, Thank you Cody!!! I have been using passport-local and figuring my way round. I highly recommend going through THIS BASIC overview before leaning on other modules\packages like passport-local and express-session.

[@kosidinna_]

i know i'm late to this but as someone who is just getting round to backend stuff, this was very useful. Thank you

[@ChangaSingh-y4n]

appreciate dumming down the complex concept

[@digvijaysingh6882]

simple and thorough. Glad you didn't use all those fancy abstractions.

[@GilP-BM]

Love your content & input, thanks Cody!

[@mayor3367]

Thank you so much. I had a hard time understanding how jwt does what it does. It is so much clearer now.

[@bentheafrican]

Nice tutorial Looking forward to watch the next one.

[@CoryTheSimmons]

Best tutorial I've ever seen.

[@SeibertSwirl]

Great job babe!!! You’re killin this!

[@raprincis]

Simple, helpful, and very instructive

[@exe.m1dn1ght]

I love this explanation ! thanks Cody !

[@offgridvince]

Great video! Thx

[@mferino1960]

Great video, thanks so much! I am about to build something using remix-auth (which is my first ever auth implementation) and wasn't clear on the cookie / session relationship. Most of the things I found just by browsing the web were like, the session is stored on the server and the cookie is stored on the client... thanks, that helps me not at all. This video cleared it all up and I now have a working mental model.

[@aiknowledge-n2s]

Simply put together

[@cristianadejola464]

just subscribe to your channel. you are really helping the junior Dev. Thanks so much

[@alexvolkov529]

Hi! Thank you for your video! I have a question how I can store sessionId on my frontend in production?Just using the domain attribute does not work since I'm using a free hosting wich is the Public Suffix List and after all frontend and backend are hosted on different subdomains. Should I store sessionId on the front-side? Or is it not the case?

[@tljstewart]

Great content

[@alexdonoaga89]

whats the extension name for copilot that you used to recive the delete cookie thing ?

[@codinginflow]

Can you tell me what's this VS Code theme? It's beautiful

[@WebDevCody]

I think this is material community high contrast

[@codinginflow]

@@WebDevCody Thank you

[@blackpeep984]

shades of purple

[@codinginflow]

@@blackpeep984 That's what I thought actually

[@blackpeep984]

@@codinginflow it's my personal favorite so i knew right away what theme he's using

[@AnonymousPumpkin616]

can u provide the code?

[@lightsinvalues9856]

thank you very much

[@captainalpha4853]

Hello, I'm using express-session package. When i log in, i see that there is a cookie in the response. However, when i try to make a new request to the server, I don't see the cookie in the request header. PS: I'm using Nuxt3 for client side.

[@WebDevCody]

If you’re using axios or fetch you usually have to specify withCredentials true for all your requests

[@ponderatulify]

How do you go about storing the session? Removing the session? How does it scale?

[@tudor14]

You could store the session in Redis and other user info too (but the session ID is only sent back in cookie). Removing the session you'd just find the session based on sessionId in your store/database and delete it.. And for scaling well lets just say you're on your own there...

[@velara314]

If I need to authenticate across two different domains should I use Jwt or sessions?

[@WebDevCody]

I think jwt might be easier. sessions usually use cookies which often suggest same-site policies. I'd have to research this question to be honest., but google single sign on approaches

[@sjfieksnd]

Cool!

[@notfadeaway6617]

nice video

[@bamideleprecious3481]

What plugin can I use

[@WebDevCody]

Material community

[@brianpolly-ei3nk]

Are you on telegram

[@ashajanet12-a92]

This is wayy good explanation!🫴✨