Session-Based Auth Fundamentals

Prerequisites: Node.js installed, basic Express routing, a local Redis instance (or Docker).

Version note: verified against current documentation as of July 2026. express-session remains the standard session middleware for Express, paired with connect-redis for a production-grade store (the default MemoryStore leaks memory and is explicitly unsuitable for production per the express-session docs). Password hashing uses argon2 (argon2id) rather than bcrypt — OWASP's current Password Storage Cheat Sheet lists Argon2id as its first-choice recommendation, with bcrypt as an acceptable fallback where Argon2 isn't available. Cookie defaults referenced (httpOnly, secure, sameSite) reflect the current express-session API.

Before OAuth, JWTs, or passkeys existed, there was a simple idea: the server remembers who you are and hands your browser a token to prove it on every subsequent request. That's a session. It's still the right default for a classic server-rendered or same-origin app, because unlike a JWT, the server can instantly revoke a session by deleting one row — no token blocklist required. This project builds the whole loop: hash a password on signup, verify it on login, issue a signed session cookie, and store the session server-side in Redis so it survives a server restart.