Session Cookies on Express.JS

Question

everyone!

I'm using Express-Session to manage my serverside session, so, when I get the user data and set it to my sessions variables it has value perfectly, but if I try to use them in other file, it get only the cookie header but not my variables. I'm using postman, if it matters.

My server.js

var express = require('express'),
    bodyparser = require('body-parser'),
    validator = require('express-validator'),
    session = require('express-session'),
    app = express();

var consign = require('consign');
app.use(bodyparser.urlencoded({ extended: true }));
app.use(bodyparser.json())
app.use(validator())
app.use(session({
    secret: 'iau#$%#$Hgs@#t4',
    resave: false,
    saveUninitialized: false
}))

consign()
    .include('./src/routes')
    .then('./src/controllers')
    .then('./src/config/conexao.js')
    .then('./src/models')
    .then('./src/utils')
    .into(app);


app.listen(3000, function () {
    console.log("Servidor ON");
});

module.exports = app;

Function that autenticates the user:

module.exports.autenticar = function (app, req, res) {

    var valido = app.src.utils.functions.validaUsuarioLogin(app, req);
    if (valido == true) { //true significa que não deu erro
        const conexao = new app.src.config.conexao.Conexao(),
            usuario = new app.src.models.usuariosDAO.UsuariosDAO()
        let dadosusuario = req.body;

        usuario.autenticar(conexao, dadosusuario, (err, result) => {
            if (err) {
                res.json(conexao.trataErros(err))
            } else if (result.length != 0) {
                //Permissoes Gerais
                req.session.exibecadastros = result[0].exibecadastros
                //Permissoes para Tarefas
                req.session.aprovatarefa = result[0].aprovatarefa;
                req.session.cancelatarefa = result[0].cancelatarefa
                req.session.alteratarefa = result[0].alteratarefa
                req.session.criatarefa = result[0].criatarefa
                //Permissao para Cargos
                req.session.criacargo = result[0].criacargo
                req.session.atualizacargo = result[0].atualizacargo
                req.session.deletacargo = result[0].deletacargo
                req.session.visualizacargos = result[0].visualizacargos
                console.log(req.session) //here we have data from the variables above
                //   res.json(result)
            }
            else {
                let msg = {
                    msg: "Nenhum usuario encontrado com essas informações."
                }
                res.send(msg)
            }
        }) //saindo da função de autenticação
    } else {
        res.send(valido)
    }
}

my route that I want to protect:

module.exports = function (app) {
    app.get('/cargos', function (req, res) {
        console.log(req.session) // Here I have only cookie headers
        app.src.controllers.cargos.getCargos(app, req, res)
    });
}

It this console.log(req.session) it says

Session {
  cookie:
   { path: '/',
     _expires: null,
     originalMaxAge: null,
     httpOnly: true } }

Answer 1

From my own experience in dealing with express.js/cookies/session and testing through Postman, I had found that if it doesn't maintain the cookies. I've always had to add the cookie/session myself to Postman or capture a session using the Postman plugin in Chrome on the actual site.

Try doing the steps directly in a browser, or make sure you add the cookie that is returned to the next request you send.