Authorization Using Sessions

Authorization Using Sessions

• Sessions are a technique to store user state and data on the server, similar to cookies, but server-side.
• Sessions act like server variables, accessible across all routes in the server after creation.

Data Storage Options for Sessions

• Application Memory
  • This is the simplest method.
  • It consumes server memory.
  • Data is lost if the server crashes.
  • It's primarily for development, not production.
• Memory Cache
• Cookie
  • This is a popular method.
  • It consumes bandwidth with every data exchange with the server.
  • It's limited by cookie size (around 4 KB).
  • Security should be a concern.
• File or Database

Implementation

• Sessions with application memory and files are preferred for their simplicity and practicality.
• In Node.js, express-session is a plugin to simplify session use.
• Installation is done via npm install express-session.

Session Usage

• Sessions are created server-side.
• They store values shared across all back-end services.
• Example: remembering user info after login for use on another page.

Login/Welcome Page Example

• Correct credentials ("admin"/"1111" or "user"/"2222") redirect to a welcome page.
• The welcome page uses session data to display the user's ID and username.
• Already logged-in users bypass the login page, redirecting to the welcome page.

app.js Configuration

• Express, path, and express-session are required
• The "public" folder is set as a static folder for direct user access.
• Express.json() and express.urlencoded() are used for JSON exchange.
• Session middleware configures session settings like cookie max age, secret code, resave, and saveUninitialized.

Login Route

• Handles user login by checking username and password.
• On successful login, keeps the username and userID in the session.
• Redirects to the "/welcome" route.
• Sends "Login failed" with a 401 status for incorrect credentials.

Logout Route

• Clears the session variable using req.session.destroy().
• Handles errors during session clearing, sending a 500 status if it fails.
• Redirects to the homepage ("/") upon successful logout.

Get Username Route

• Retrieves user information (userID and username) from the session.
• Returns user data as JSON if a session exists.
• Sends "No user info" with a 401 status if no session exists

Welcome Route

• Checks for a session
• Sends the "welcome.html" file
• Otherwise redirects to "/"

Root Route

• Checks if a user is already logged in via session.
• Redirects logged-in users to "/welcome".
• Serves "index.html" (login page) for non-logged-in users.

Client-Side Login Script

• The login form prevents default submission
• It retrieves username and password from input fields.
• It sends a POST request via fetch with the user credentials.
• It redirects to the welcome page upon successful login.
• It displays an error message using SweetAlert2 for login failure or connection errors.

Logout Implementation

• The logout button calls the /logout route which clears the session
• This redirects to the login page

Session Stores

• Default sessions are stored in server memory and are lost when the server is closed.
• This creates memory leak
• This can be solved with a session store (e.g. MemoryStore)
• MemoryStore can be installed via npm install memorystore

Session Store Setup

• After installation, require memorystore inside app.js
• When calling app.use(session({...}) add store: new MemoryStore({...}) inside the object
• Also add a checkPeriod with appropriate prune timings

Session with Database Example

• Create a database called 'webpro' with two tables called 'user' and 'product'
• 'user' will contain user information such as ID, username, password, and role
• 'product' will contain product information such as ID, product name, price, amount, and image
• Passwords in the database should me hashed with 'bcrypt'
• When using the login functionality, the password in the database should be compared with the username from the user input
• The database and table structure must be setup properly

Summary

• Sessions are server-side
• Sessions are necessary for keeping track of users
• Sessions help increase web-security
• Sessions can help prevent unauthorized users from calling APIs
• Using sessions must handle the 'memory leak' possibility
• It's possible to store sessions in databases, and configure roles