CODEWITHSUNDEEP
javascriptnode.jscookies
user5041486
user5041486

Reputation:

Express Session and Cookie

I don't understand how serializing and deserializing work with express session.

When I installed Express-session it said that I needed a serialize and deserialize function:

passport.serializeUser(function(user, done) {
  done(null, user._id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function(err, user) {
    done(err, user);
  });
});

Server.js Post route from login form:

router.post('/login', passport.authenticate('login', {
    successRedirect: '/home',
    failureRedirect: '/',
    failureFlash : true 
}));

My question is when the user attempts to login from the form on my HTML and hits the endpoint as specified above '/login', is this where express session comes into play? So express session will create a cookie with a session id as user._id as specified in my serializeUser function and it will give this cookie to the client? So now when the client makes any subsequent requests to that same server at the endpoint '/login', it will automatically call deserialize user without going through the passport middleware that is provided in the router.post('/login', ...)?

I am not sure when and where these two serialize functions are called and how express session actually uses them? Any clarification would be appreciated.

Upvotes: 0

Views: 1400

Answers (1)

Sejal Gupta
Sejal Gupta

Reputation: 11

To understand this, we have to go through the basic idea of what is a cookie and how does it work?

Cookie:

It is collection of data that is stored in computers browser and is sent with every request to the server in request headers and received by the browser from server in response headers.

What is need of a cookie?

Now we know that http requests are stateless (means every request is a fresh request for server that is for example if u login to some website which is the first request made by you and then u make a second request to display your profile then at this point server does not know who are u), so for authorisation the server needs to know who u are and this information is stored in a cookie. When u log in , ur credentials are send to the server and server sets these credentials in cookie which is then send to the browser , and after that every request u make , that cookie is send back to the server which is then verified and hence allowing u to access the relevent information.

Now a point should come into your mind that are cookies safe for storing users credentials?

The answer is a big NO , as as the user can manipulate it at his/her leisure . Yes a cookies data can be manipulated anytime , so its not safe to store user credentials in cookie , so whats the solution ? Here we come to idea of sessions.

Sessions:

Session is an object that is stored in server side instead of browser and hence remains safe. Now how it helps in authorisation , see: When user signs in , request is sent to server and an object session is made which stores the credential of users and this session object is given a unique id which is encrypted using that serializerUser() function and this id is stored in cookie and which is then send to browser. Now the user if try also to manipulate it , he/she cannot as the cookie just contains the session id which is encrypted and can not be decoded by any means. And then this cookie is send to browser with another request which then goes through deserializeUser() function and gets decoded which matches with the stored session id hence verifying the user.

Upvotes: 1

Related Questions