Express Session not Saving/Finding Session

Question

I am using express-session to try to use the session and it doesn't seem to find or save the session.

I would expect the response to increment after each call however with repeated requests with Postman or a basic svelte app, it keeps returning 0.

How do i get it to find the already saved session and return incremented values?

Node.js:

const express = require('express')
const app = express()
const session = require('express-session');

app.use(function(req, res, next) {
  res.header("Access-Control-Allow-Origin", "http://localhost:5000"); // update to match the domain you will make the request from
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
  next();
});

app.use(session({
    genid: function(req) {
        return 1
    },
    proxy: true,
    secret: "max",
    resave: false,
    saveUninitialized: true
}));

app.get('/', function (req, res) {
    console.log(req.session)
    if (!req.session.views) {
        req.session.views=0;
    }
    res.send((req.session.views++).toString());
    console.log(req.session)
})

app.listen(3000)

Basic svelte:

<script>
    export let name;
    let resp = "";
    async function sendReq() {
        resp = await fetch("http://localhost:3000/");
        console.log(resp);
        resp = await resp.text();
        console.log(resp);
    }
</script>

<main>
    <h1>Hello {name}!</h1>
    <p>Visit the <a href="https://svelte.dev/tutorial">Svelte tutorial</a> to learn how to build Svelte apps.</p>
    <button on:click={sendReq}>Click me</button>
    {resp}
</main>

<style>
    main {
        text-align: center;
        padding: 1em;
        max-width: 240px;
        margin: 0 auto;
    }

    h1 {
        color: #ff3e00;
        text-transform: uppercase;
        font-size: 4em;
        font-weight: 100;
    }

    @media (min-width: 640px) {
        main {
            max-width: none;
        }
    }
</style>

Answer 1

fetch() by default does not send cookies with its request. So, with no cookies, your server doesn't see the session cookie and then won't find your previous session object. You need to add the credentials: "include" or credentials: "same-origin" option:

resp = await fetch("http://localhost:3000/", {credentials: "include"});

You may also need to call session.save() after changing the session object so your change will persist.

Some other comments on your code:

1. For most sessions with a real data store behind them, you need to call session.save() after you modify the session object to assure it is saved back to the data store. You probably don't need that for the default memory-based store, but it's a good general practice since production code will probably move away from the memory-based store at some point.

2. Your hardcoding of genid() to always return 1 will break a bunch of features in sessions. Don't do that. The default implementation of genid() will work just fine for your purposes so you can just remove that method definition entirely.

3. You don't show code for loading your web page from your server. If you're not getting the web page itself from your web server so the fetch() call is a same-origin call, then you may also have cors issues (cross origin restrictions).

4. In your client code, you should move the definition of the variable resp inside your sendReq() function so it is a local variable and would not be trounced if more than one call to sendReq() were ever in flight by the same page.