Beginner LevelAuthentication & Authorization
How does traditional Cookie-Based Stateful Session Authentication work?
❓ Interview Prompt: Explain session creation, server session stores (Memory/Redis), session cookies, and request validation.
Cookie-Based Stateful Session Authentication is the classic web application security pattern:
Execution Flow:
1
Credentials Submission: Client sends username/password via POST to '/api/login'.
2
Server Session Creation: Upon credential verification, the server creates a unique, cryptographically random Session ID (e.g. 128-bit UUID/entropy) and stores user context in server RAM or Redis store.
3
Set-Cookie Header: Server responds with a 'Set-Cookie: session_id=abc123xyz; HttpOnly; Secure; SameSite=Lax' response header.
4
Automatic Request Inclusion: The browser automatically includes the 'session_id' cookie in every subsequent HTTP request to that domain.
5
Validation: Server looks up 'session_id' in Redis to retrieve user permissions.
Code Implementation Example
typescript
import expressSession from 'express-session';
import RedisStore from 'connect-redis';
import { createClient } from 'redis';
const redisClient = createClient({ url: 'redis://localhost:6379' });
// Express stateful session configuration backed by Redis
app.use(expressSession({
store: new RedisStore({ client: redisClient }),
secret: process.env.SESSION_SECRET!,
resave: false,
saveUninitialized: false,
cookie: {
httpOnly: true,
secure: true, // Requires HTTPS
sameSite: 'lax',
maxAge: 1000 * 60 * 60 * 24 // 24 Hours
}
}));💡Configuring Express.js stateful session authentication backed by a Redis store.
🎯 Interview Key Takeaway
Stateful sessions store user context on the server (Redis) referenced by an opaque HTTP-only session cookie.
#Sessions#Cookies#Redis#Express#Beginner
Back to all Authentication & Authorization Questions→