Express 5 + express-session login flow, e2e-style over real HTTP with a cookie jar: working versions (tested 2026-10-15)

{
  "name": "express-session-cookie-e2e",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "express-session": "1.19.0"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "fetch-cookie": "3.2.0",
    "@types/express": "5.0.6",
    "@types/express-session": "1.19.0"
  }
}

import express from "express";
import session from "express-session";

declare module "express-session" { interface SessionData { user?: string } }

export function createApp(secret: string) {
  const app = express();
  app.use(express.urlencoded({ extended: false }));
  app.use(session({
    secret, resave: false, saveUninitialized: false, name: "sid",
    cookie: { httpOnly: true, sameSite: "lax", secure: false /* true behind HTTPS */, maxAge: 3600_000 },
  }));
  app.post("/login", (req, res, next) => {
    if (req.body.password !== "secret") return res.status(401).send("bad credentials");
    req.session.regenerate((err) => { // new session id on login prevents fixation
      if (err) return next(err);
      req.session.user = req.body.username;
      res.redirect(303, "/dashboard");
    });
  });
  app.get("/dashboard", (req, res) => {
    if (!req.session.user) return res.redirect(303, "/login");
    res.send(`Welcome ${req.session.user}`);
  });
  app.post("/logout", (req, res) => { req.session.destroy(() => res.clearCookie("sid").redirect(303, "/login")); });
  app.get("/login", (_req, res) => { res.send("login page"); });
  return app;
}

import { test, before, after } from "node:test";
import assert from "node:assert/strict";
import type { Server } from "node:http";
import makeFetchCookie from "fetch-cookie";
import { createApp } from "../src/app.ts";

let server: Server, base: string;
before(() => new Promise<void>((r) => { server = createApp("test-secret").listen(0, () => { base = `http://127.0.0.1:${(server.address() as any).port}`; r(); }); }));
after(() => new Promise<void>((r) => server.close(() => r())));

test("full browser-like flow: login, dashboard, logout", async () => {
  const jar = new makeFetchCookie.toughCookie.CookieJar();
  const f = makeFetchCookie(fetch, jar);
  assert.equal(await (await f(`${base}/dashboard`)).text(), "login page"); // redirect followed
  const login = await f(`${base}/login`, { method: "POST", body: new URLSearchParams({ username: "ada", password: "secret" }) });
  assert.equal(await login.text(), "Welcome ada");
  const cookie = (await jar.getCookies(base))[0];
  assert.equal(cookie.key, "sid");
  assert.equal(cookie.httpOnly, true);
  await f(`${base}/logout`, { method: "POST" });
  assert.equal(await (await f(`${base}/dashboard`)).text(), "login page");
});

test("bad password is 401 and sets no session", async () => {
  const jar = new makeFetchCookie.toughCookie.CookieJar();
  const f = makeFetchCookie(fetch, jar);
  const r = await f(`${base}/login`, { method: "POST", body: new URLSearchParams({ username: "x", password: "nope" }) });
  assert.equal(r.status, 401);
  assert.equal((await jar.getCookies(base)).length, 0);
});