Set Secure Cookie Flags (HttpOnly, Secure, SameSite) in Express

const express = require('express');
const cookieParser = require('cookie-parser');
const session = require('express-session'); // For session management

const app = express();

app.use(cookieParser());
app.use(session({
  secret: 'your_strong_secret_key_here', // Used to sign the session ID cookie
  resave: false, // Don't save session if unmodified
  saveUninitialized: false, // Don't create session until something stored
  cookie: {
    httpOnly: true, // Prevents client-side JavaScript from accessing the cookie
    secure: process.env.NODE_ENV === 'production', // Ensures cookie is sent only over HTTPS
    sameSite: 'Lax', // Protects against CSRF attacks. Can be 'Strict', 'Lax', or 'None'
    maxAge: 1000 * 60 * 60 * 24 * 7 // 1 week
  }
}));

app.get('/', (req, res) => {
  // Set a session value
  if (req.session.views) {
    req.session.views++;
  } else {
    req.session.views = 1;
  }
  res.send(`You have visited this page ${req.session.views} times. Session ID: ${req.session.id}`);
});

app.get('/set-custom-cookie', (req, res) => {
  res.cookie('custom_data', 'some_value', {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'Lax',
    maxAge: 1000 * 60 * 5 // 5 minutes
  });
  res.send('Custom secure cookie set!');
});


const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});