Read a signed user identifier after cookie-parser validates it.
Authentication
Express.js · Pipe
req.signedCookies
req.signedCookies is the request object containing signed cookies validated and unsigned by cookie-parser. It is an empty object when the request carries no signed cookies.
How it works
req.signedCookies is an object populated by cookie-parser when configured with a secret. It contains signed request cookies after validation, with their signatures removed so application code can use the resulting values; when no signed cookies are present, it is an empty object.
Syntax
req.signedCookiesReturns
Object containing validated signed cookies with unsigned values; defaults to {} when no signed cookies are sent.
Key points
- cookie-parser supplies the property from signed cookies received in the request.
- After successful validation, each stored value is available without its signing marker.
- The separate object distinguishes values the application intends to treat as verified.
- Tamper detection relies on keeping the signing secret private.
Common mistakes
- Signing provides tamper detection, not confidentiality; signed cookie contents remain readable.
- Handle the property as an object that may contain no entries.
- Use the dedicated signed-cookie collection rather than treating ordinary cookie values as trusted.
Example: Read a signed cookie
const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();
app.use(cookieParser(process.env.COOKIE_SECRET || 'development-secret'));
app.get('/profile', (req, res) => {
const user = req.signedCookies.user;
if (typeof user !== 'string') return res.sendStatus(401);
res.json({ user });
});
app.listen(3000);The middleware verifies signed cookies and makes their unsigned values available through req.signedCookies.
When to use it
Reject or ignore requests whose signed cookie values cannot be trusted.
Tamper detection
Expose a verified cookie-derived value to route handlers without parsing the header manually.
Request context
Interview questions
QWhat does req.signedCookies contain?
It is an object on the request containing signed cookies after cookie-parser has checked them and removed their signatures. The values are therefore unsigned and ready for application use.
Follow-up: What middleware setup is required? Configure cookie-parser with the signing secret before the route that reads req.signedCookies.
QHow is req.signedCookies populated?
The property is populated when cookie-parser middleware is used with signed-cookie support. A signed cookie is moved into this collection after validation instead of remaining in req.cookies.
Follow-up: What happens without a secret? Signed-cookie support is not configured, so the application should not expect verified signed values in this property.
QDoes signing encrypt a cookie?
Signing prevents tampering because validation depends on a private secret. It does not hide or encrypt the cookie value, so it must not be treated as confidential storage.
Follow-up: Where should sensitive data go? Store sensitive information in a protected server-side system and keep only a suitable identifier in the cookie.
Related
req.cookiescookie-parsercookieParser.signedCookiecookieParser.signedCookiesres.cookie()