0

I've started to add express-session to my express server app. I've managed to get persistent sessions, but now I've noticed that for different tabs and even different instances/windows of Chrome I'm getting the same session id.

Only by starting an incognito session am I getting a different session id, but then it in fact differs on every reload, which is again surprising to me.

So how does express actually tell different requests from another?

I'm working in a dev setup with an angular client (http://localhost:4200) making requests to my express server sitting on http://localhost:3000. This is my api setup:

    this.app.use(
      cors({
        credentials: true,
        origin: 'http://localhost:4200',
      })
    );
    this.app.use(
      session({
        secret: "Don't tell anyone!",
        resave: false,
        saveUninitialized: true,
        cookie: {
          sameSite: 'none',
          secure: true,
        },
      })
    );

and the client request is:

    return this.httpClient
      .get<T>(`${this.baseUrl}/api/resource/table`, {
        params: query,
        withCredentials: true,
      })

So maybe in the real world it would behave differently. But that's something I cannot test. So I would be happy about some deeper insight on how this works under the hood.

Actually I was hoping to get a different session for every different tab, or in general for every client/browser that is accessing my api. Can this even be done?

DonFuchs
  • 371
  • 2
  • 14
  • It sets a cookie. Cookies are shared between tabs – Konrad Aug 27 '23 at 21:53
  • There are good explanations [here](https://stackoverflow.com/questions/5522020/how-do-sessions-work-in-express-js-with-node-js) with numerous linked explanations to read within that posted question. See [here](https://stackoverflow.com/questions/23566555/whats-the-difference-between-express-session-and-cookie-session) too. – jQueeny Aug 27 '23 at 22:50
  • Thx. But this answers only how it's working on the express side. Nothing about how those cookies are handled in the browser. – DonFuchs Aug 28 '23 at 04:40
  • Is it correct to say that exactly the `SessionOptions` passed to `session()` are telling the browser how on different requests he shall set different cookies? – DonFuchs Aug 28 '23 at 05:05

0 Answers0