When diving into web apps with Node.js and Express, tackling cookies is a big deal. Cookies play a huge role in keeping user sessions smooth, tracking what users are up to, and just making the whole experience better. Here’s where cookie-parser
comes in handy, because, well, Express doesn’t handle cookies out-of-the-box.
First thing’s first, you gotta install cookie-parser
. It’s super straightforward with npm. Toss this command in your terminal:
npm install cookie-parser
Once you’re done, bring that bad boy into your Express app by requiring it.
Now, let’s set it up as middleware in your app. Middleware in Express is just something that takes your request, does some magic to it, and then hands it off to the next piece in the stack. Here’s how you sprinkle some cookie-parser
into your setup:
const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();
const port = 80;
app.use(cookieParser());
app.listen(port, () => {
console.log(`Server running on port ${port}`);
});
This snippet is your basic setup. That line app.use(cookieParser());
is doing the trick—now all the cookie data coming from client requests will be neatly tucked into req.cookies
.
Sending cookies back to the client? Piece of cake! You use the res.cookie()
method. Check this out:
app.get('/send', (req, res) => {
res.cookie('loggedin', 'true');
res.send('Cookie sent!');
});
When someone hits /send
with a GET request, the server says, “Hey, here’s a cookie named loggedin
,” and sets its value to true
.
But what about reading cookies? With cookie-parser
in action, it’s as easy as peeking into req.cookies
. Here’s how you check if that loggedin
cookie is there:
app.get('/read', (req, res) => {
let response = 'Not logged in!';
if (req.cookies.loggedin === 'true') {
response = 'Yup, you are logged in!';
}
res.send(response);
});
Simple, right? If the cookie is there and its value is true
, you let the user know they’re in.
Now, we can step it up a notch with signed cookies—basically, cookies with a bit of extra security. Here’s how you handle that:
const secret = 'your-secret-key';
app.use(cookieParser(secret));
app.get('/send-signed', (req, res) => {
res.cookie('loggedin', 'true', { signed: true });
res.send('Signed cookie sent!');
});
app.get('/read-signed', (req, res) => {
let response = 'Not logged in!';
if (req.signedCookies.loggedin === 'true') {
response = 'Yup, you are logged in!';
}
res.send(response);
});
With this, you initialize cookie-parser
with a secret. When you send that cookie, just tag it with { signed: true }
. Signed cookies show up in req.signedCookies
.
Ever thought about storing more complex data—like JSON? cookie-parser
has your back. JSON cookies are parsed automatically:
app.get('/send-json', (req, res) => {
res.cookie('user', { name: 'John', age: 30 }, { encode: String });
res.send('JSON cookie sent!');
});
app.get('/read-json', (req, res) => {
const user = req.cookies.user;
if (user) {
res.send(`Hello, ${user.name}. You are ${user.age} years old.`);
} else {
res.send('No user data found.');
}
});
Send a JSON cookie like that and when reading it, it pops out as a neat JSON object.
Got a cookie you want to get rid of? Use res.clearCookie()
. Here’s a quick way to delete a cookie:
app.get('/clear-cookie', (req, res) => {
res.clearCookie('loggedin');
res.send('Cookie deleted!');
});
Hit /clear-cookie
with a GET request and boom! The loggedin
cookie is history.
A word about security—while cookie-parser
makes handling cookies a breeze, it doesn’t cover all your security bases. If you’re gunning for serious security, you may want to look into express-session
or cookie-session
. They provide extra bells and whistles like secure settings and customizable configurations for managing sessions securely.
In conclusion, cookie-parser
is your go-to when it comes to making cookie management a walk in the park in your Express app. With it, sending, reading, and deleting cookies is straightforward, and you can even throw signed and JSON cookies into the mix. Always keep an eye on best security practices to keep your users’ data safe and sound.