Express Cookies

Reading and Setting Cookies

Express can set cookies out of the box with res.cookie(), but reading them back requires the cookie-parser middleware, without it, req.cookies is undefined.

Cookies sent to the browser support several important options: httpOnly (inaccessible to JavaScript, protecting against XSS theft), secure (only sent over HTTPS), and sameSite (controls cross-site sending behavior).

const cookieParser = require('cookie-parser');
app.use(cookieParser());

app.get('/set-cookie', (req, res) => {
  res.cookie('theme', 'dark', { httpOnly: true, maxAge: 86400000 });
  res.send('Cookie set');
});

app.get('/read-cookie', (req, res) => {
  res.json({ theme: req.cookies.theme });
});

maxAge is in milliseconds; here the cookie expires after 24 hours (86400000 ms).

res.cookie() Options

res.cookie(name, value, {
  httpOnly: true,   // not accessible via document.cookie
  secure: true,      // only sent over HTTPS
  sameSite: 'lax',   // 'strict' | 'lax' | 'none'
  maxAge: 86400000,  // lifetime in milliseconds
  signed: true,       // requires cookie-parser secret
});

• httpOnly: true should be set on any cookie storing sensitive session data.
• secure: true must be used in production, requiring HTTPS.
• sameSite: 'strict' or 'lax' helps mitigate CSRF attacks.
• Signed cookies detect tampering, but do not encrypt the value, never store secrets directly in a cookie.

Cookies Cheatsheet

Common cookie operations and options in Express.

Signed Cookies

Signed cookies add a cryptographic signature so the server can detect if a client tampered with the value, without needing to encrypt it. Pass a secret string into cookieParser() and set signed: true when setting the cookie.

app.use(cookieParser(process.env.COOKIE_SECRET));

app.get('/set-signed', (req, res) => {
  res.cookie('userId', '42', { signed: true, httpOnly: true });
  res.send('Signed cookie set');
});

app.get('/read-signed', (req, res) => {
  res.json({ userId: req.signedCookies.userId });
});

Signed cookies appear on req.signedCookies, not req.cookies.

Clearing Cookies

To log a user out or reset a preference, clear the cookie with res.clearCookie(), passing the same options (path, domain) used when it was originally set.

app.post('/logout', (req, res) => {
  res.clearCookie('token', { httpOnly: true });
  res.json({ loggedOut: true });
});

Common Mistakes

• Storing sensitive data (like a raw password or full user object) in an unsigned, non-httpOnly cookie.
• Forgetting secure: true in production, allowing cookies to be sent over plain HTTP.
• Reading req.cookies without registering cookie-parser first.
• Trying to clear a cookie without matching the original path/domain options, silently failing to remove it.

Key Takeaways

• cookie-parser is required to read cookies via req.cookies; setting them works out of the box.
• httpOnly, secure, and sameSite are essential security options for any sensitive cookie.
• Signed cookies detect tampering but do not hide or encrypt the underlying value.
• res.clearCookie() removes a cookie, matching the options it was originally set with.