Secure authentication cookies
Set a session or authentication cookie with browser-access restrictions.
Express.js · Interface
CookieOptions
CookieOptions is the options object used with Express's cookie-setting API. It configures attributes such as lifetime, scope, HTTPS-only delivery, client-side access, SameSite behavior, signing, and partitioned storage.
How it works
CookieOptions is the options object accepted by Express's cookie-setting API. Its properties control cookie scope, lifetime, transport security, browser access, signing, encoding, and related Set-Cookie attributes.
Syntax
res.cookie(name, value, [options])Parameters
| Name | Type | Description |
|---|---|---|
name | String | Cookie name. |
value | String | Object | Cookie value; an object is serialized as JSON. |
options | Object | undefined | Options for the Set-Cookie header. |
Returns
Sets cookie name to value.
Key points
- The options object controls attributes written to the response's Set-Cookie header.
- Use maxAge for an expiration interval measured in milliseconds from the current time.
- httpOnly prevents browser client-side code from accessing the cookie.
- secure restricts the cookie to HTTPS requests.
- sameSite controls the cookie's SameSite attribute and accepts a Boolean or String.
- signed requests cookie signing when the application has the required signing configuration.
- partitioned enables partitioned cookie storage for supported browser behavior.
Common mistakes
- Setting options only creates the response header; the browser enforces the resulting cookie behavior.
- Unspecified properties use the relevant RFC 6265 defaults, so do not assume application-specific defaults.
Example: Set a secure cookie
const express = require('express');
const app = express();
app.get('/login', (req, res) => {
res.cookie('session', 'abc123', {
httpOnly: true,
secure: true,
sameSite: 'lax',
maxAge: 60 * 60 * 1000
});
res.sendStatus(204);
});
app.listen(3000);This route sets a one-hour cookie that is restricted from client-side JavaScript, sent over HTTPS, and subject to SameSite=Lax behavior.
When to use it
Cookie expiration
Define how long a cookie remains valid.
Scope and SameSite controls
Limit where and when a browser sends a cookie.
Related
res.cookie()res.clearCookie()httpOnlysecuresameSitesignedpartitioned