Request Processing

Session Management

Server-side session storage with support for memory and Redis stores for scalable session management.

Basic Session Setup

MoroJS provides built-in session management middleware with support for memory-based and Redis-based session storage.

Memory-Based Sessions

typescript

1import { session } from '@morojs/moro';
2
3// Memory-based sessions (development)
4app.use(session({
5  secret: 'your-secret-key',
6  store: 'memory',
7  cookie: {
8    maxAge: 24 * 60 * 60 * 1000, // 24 hours
9    httpOnly: true,
10    secure: process.env.NODE_ENV === 'production',
11    sameSite: 'strict'
12  }
13}));
14
15// Using sessions
16app.post('/login', (req, res) => {
17  req.session.userId = user.id;
18  req.session.role = user.role;
19  return { success: true };
20});
21
22app.get('/profile', (req, res) => {
23  if (!req.session.userId) {
24    return res.status(401).json({ error: 'Unauthorized' });
25  }
26  return { userId: req.session.userId };
27});
28
29app.post('/logout', (req, res) => {
30  req.session.destroy();
31  return { success: true };
32});

Session Features

Secure session cookie with httpOnly flag
Automatic session expiration
Session data stored server-side
Support for memory and Redis stores
Automatic session cleanup

Redis Session Storage

Redis-Based Sessions

typescript

1import { session } from '@morojs/moro';
2
3// Redis sessions (production)
4app.use(session({
5  secret: process.env.SESSION_SECRET,
6  store: 'redis',
7  redis: {
8    host: 'localhost',
9    port: 6379,
10    password: process.env.REDIS_PASSWORD
11  },
12  cookie: {
13    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
14    httpOnly: true,
15    secure: true,
16    sameSite: 'strict'
17  }
18}));
19
20// Sessions are automatically stored in Redis
21app.post('/login', (req, res) => {
22  req.session.userId = user.id;
23  req.session.role = user.role;
24  req.session.lastLogin = new Date().toISOString();
25  return { success: true };
26});

Best Practices

Do

Use Redis for production deployments
Set secure cookie flags in production
Use strong session secrets
Set appropriate maxAge values
Destroy sessions on logout
Store minimal data in sessions

Don't

Store sensitive data in sessions
Use memory store in production
Use weak session secrets
Set very long session expiration
Store large objects in sessions
Skip session cleanup