Configuring Secure HTTP-Only Cookies with SameSite (Node.js)

const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();

app.use(cookieParser());

app.get('/set-secure-cookie', (req, res) => {
  // Set a cookie with essential security flags
  res.cookie('session_token', 'random_secure_value_123',
    {
      httpOnly: true,     // Prevents client-side JavaScript access to the cookie
      secure: true,       // Ensures the cookie is only sent over HTTPS
      sameSite: 'Lax',    // Mitigates CSRF attacks; 'Strict' is even stronger but might impact user experience
      maxAge: 3600000,    // Cookie expiration in milliseconds (1 hour)
      // domain: '.example.com', // Uncomment and set your domain for cross-subdomain cookies
      // path: '/api/',      // Uncomment and set path if the cookie should only be sent for specific paths
    }
  );
  res.send('Secure cookie set!');
});

app.get('/read-cookie', (req, res) => {
  // Note: httpOnly cookies are not accessible by client-side JavaScript
  // They are automatically sent by the browser with requests to the server.
  // Server-side, you can access them via req.cookies
  const token = req.cookies.session_token;
  if (token) {
    res.send(`Session token (server-side): ${token}`);
  } else {
    res.send('No session token found.');
  }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});