Welcome to this lesson on Session-Based Authentication. In the previous lesson, we explored API authentication using API keys, which are stateless. Now, we will focus on session-based authentication in Node.js, where the server maintains user session information. This enables a user-friendly way to manage active sessions and access protected resources.

By the end of this lesson, you will be able to:

• Sign up, log in, and establish a session.
• Maintain session persistence using cookies in a Node.js environment.
• Access protected API endpoints securely using stored session cookies.
• Log out and terminate the session.

Session-based authentication allows users to stay logged in while interacting with different API endpoints. Unlike API keys, which require sending credentials in every request, session authentication uses cookies to maintain user state across requests.

How It Works:

1. Session Creation (Login): The user logs in with their credentials (e.g., username and password). The server responds with a session ID stored in a cookie.
2. Maintaining the Session: The client must store and manually send this session cookie with subsequent requests, allowing access to protected resources.
3. Session Termination (Logout): The user logs out, and the session is invalidated on the server, preventing further access with the old session ID.

Session-Based Authentication Flow in Node.js: Unlike browsers, Node.js does not automatically manage cookies. Therefore, we must manually store and send session cookies using tools like tough-cookie.

Node.js does not automatically store and send cookies. Instead, we use tough-cookie to manage sessions manually.

To install the necessary packages, run the following command:

Then, set up the required modules in your JavaScript file:

Session IDs are unique identifiers assigned by the server to track a user's session. When a user logs in, the server generates a session ID and sends it back to the client in a Set-Cookie header. This session ID is stored in a cookie on the client-side and is sent with subsequent requests to maintain the session.

In Node.js, cookies are not automatically managed, so we need to manually extract and store them. Here's how you can extract cookies from a response:

1. Extract Cookies from Response Headers: When you receive a response from the server, you can access the Set-Cookie header to get the cookies. The Set-Cookie header is usually an array of strings, each representing a cookie.

2. Store Cookies Using tough-cookie: Use the tough-cookie library to store the extracted cookies in a CookieJar. This allows you to manage cookies across multiple requests.

   • setCookieSync Method: This method is used to store cookies in the CookieJar synchronously. It takes a cookie string and a URL as arguments. The cookie string is parsed and stored in the CookieJar for the specified URL. This is useful for managing session cookies manually in Node.js.

3. Send Cookies with Requests: Retrieve the stored cookies from the CookieJar and include them in the headers of your requests to maintain the session.

Step 1: Log in and Store the Session Cookie

Step 1: Signing Up To create a user account:

After signing up, log in to establish a session:

Once logged in, access a protected resource:

To terminate the session:

1. Missing or Expired Session Cookie: If the server does not return a Set-Cookie header during login, authentication will fail. Always check loginResponse.headers.raw()['set-cookie'].
2. Unauthorized Requests: If a request to a protected resource fails with a 401 Unauthorized response, it likely means the session cookie was missing or expired.
3. Using fetch-cookie (Optional, but not recommended for Node.js): Some older solutions used fetch-cookie, but it has compatibility issues in modern Node.js. Manually using tough-cookie is more reliable.

In this lesson, you learned how to:

• Use session-based authentication in Node.js to persist login sessions.
• Manually manage cookies using tough-cookie.
• Extract cookies from response headers and store them for session management.
• Use the setCookieSync method to store cookies in a CookieJar.
• Implement secure login, resource access, and logout processes in a Node.js client.
• Handle common authentication issues when working with session cookies.

Now, you're ready to apply these skills in a hands-on coding task.