Harden Session Cookies Against Theft and CSRF

1. Install the session store, Redis client, and password verification library.

pnpm add express-session connect-redis redis argon2

Expected output: The packages are added to package.json and the lockfile; Express and node-postgres are already present.

2. Configure the session middleware with a __Host- cookie name, Redis storage, and attributes that forbid JavaScript access and cross-site sending.

import express from 'express';
import session from 'express-session';
import { RedisStore } from 'connect-redis';
import { createClient } from 'redis';

const app = express();
app.set('trust proxy', Number(process.env.TRUST_PROXY_HOPS ?? 1));
app.use(express.json());

const redis = createClient({ url: process.env.REDIS_URL });
await redis.connect();

app.use(
  session({
    name: '__Host-sid',
    secret: process.env.SESSION_SECRET!,
    store: new RedisStore({ client: redis, prefix: 'sess:' }),
    resave: false,
    saveUninitialized: false,
    rolling: true,
    cookie: {
      httpOnly: true,
      secure: true,
      sameSite: 'lax',
      path: '/',
      maxAge: 8 * 60 * 60 * 1000,
    },
  }),
);

Expected output: Set-Cookie uses the __Host-sid name with HttpOnly, Secure, SameSite=Lax, and Path=/; no Domain attribute is emitted.

3. Regenerate the session after verifying credentials and destroy it on logout so a pre-login ID cannot become an authenticated session.

import argon2 from 'argon2';
import pg from 'pg';

const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });

declare module 'express-session' {
  interface SessionData {
    userId: string;
  }
}

app.post('/login', async (req, res, next) => {
  const { rows } = await pool.query(
    'SELECT id, password_hash FROM app.users WHERE email = $1',
    [req.body.email],
  );
  const user = rows[0];

  if (!user || !(await argon2.verify(user.password_hash, req.body.password))) {
    res.status(401).json({ error: 'invalid credentials' });
    return;
  }

  req.session.regenerate((error) => {
    if (error) {
      next(error);
      return;
    }

    req.session.userId = user.id;
    req.session.save((saveError) => {
      if (saveError) {
        next(saveError);
        return;
      }
      res.json({ ok: true });
    });
  });
});

app.post('/logout', (req, res, next) => {
  req.session.destroy((error) => {
    if (error) {
      next(error);
      return;
    }
    res.clearCookie('__Host-sid', { path: '/' });
    res.status(204).end();
  });
});

Expected output: A successful login issues a new session ID, and logout destroys the Redis record and clears the cookie.

4. Insert a same-origin check for state-changing requests before the login and logout routes, as defense in depth beyond SameSite.

const PUBLIC_ORIGIN = process.env.PUBLIC_ORIGIN;
if (!PUBLIC_ORIGIN) throw new Error('PUBLIC_ORIGIN is required');

app.use((req, res, next) => {
  if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') {
    next();
    return;
  }
  if (req.get('origin') !== PUBLIC_ORIGIN) {
    res.status(403).json({ error: 'cross-origin request blocked' });
    return;
  }
  next();
});

Expected output: A POST with Origin https://evil.example returns 403; a POST from PUBLIC_ORIGIN reaches the route.

5. Inspect the login response headers and confirm every required cookie attribute is present.

curl -sS -D - -o /dev/null https://localhost:3000/login \
  --insecure \
  -H 'origin: https://localhost:3000' \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","password":"correct horse battery staple"}' \
  | grep -i '^set-cookie:'

Expected output: The header starts with set-cookie: __Host-sid= and includes Path=/, HttpOnly, Secure, and SameSite=Lax with no Domain attribute.

6. Verify that a cross-site POST is rejected before it can reach a state-changing route.

curl -sS -o /dev/null -w '%{http_code}\n' https://localhost:3000/logout \
  --insecure -X POST -H 'origin: https://evil.example'

Expected output: The response status is 403 and the session is not destroyed.

7. Log in twice with the same cookie jar and compare the session IDs to prove regeneration.

curl -sS -c /tmp/sid.txt https://localhost:3000/login \
  --insecure -H 'origin: https://localhost:3000' \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","password":"correct horse battery staple"}' >/dev/null
awk '$6 == "__Host-sid" { print $7 }' /tmp/sid.txt

curl -sS -b /tmp/sid.txt -c /tmp/sid.txt https://localhost:3000/login \
  --insecure -H 'origin: https://localhost:3000' \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","password":"correct horse battery staple"}' >/dev/null
awk '$6 == "__Host-sid" { print $7 }' /tmp/sid.txt

Expected output: The two printed session IDs are different, confirming that each login regenerates the session.

8. Open an authenticated page in a browser, run document.cookie in DevTools, and inspect the cookie in Application > Cookies.

Expected output: document.cookie does not contain the __Host-sid value, while the cookie table shows HttpOnly and Secure enabled.

Problem

No Set-Cookie header appears at all

Solution

secure: true requires HTTPS end to end. Check the TLS terminator, TRUST_PROXY_HOPS, and whether Express sees the request as secure.

Problem

The browser refuses to store the __Host- cookie

Solution

A __Host- cookie must be Secure, have Path=/, and omit Domain. Removing a Domain attribute added by a proxy or framework fixes it.

Problem

Same-origin POSTs return 403

Solution

The browser omitted Origin or PUBLIC_ORIGIN uses a different scheme, host, or port. Log the Origin header and compare exact strings.

Problem

Users are logged out after every deploy

Solution

The session store is in memory or the SESSION_SECRET changed. Use Redis and keep the secret stable across rolling instances.