Module Overview

What You’ll Learn

• Explain how session-based authentication works, from login to a protected request
• Use express-session to create and read a logged-in session
• Protect a route so it only responds to a logged-in user

💡 Why this matters: Module 1 built a way to verify a password. This module turns that single check into a persistent “logged in” state, the traditional way a web application remembers who’s making each request.

What’s Covered

• How sessions work, a session store, a session ID, and a cookie tying a browser to server-side state.
• express-session, wiring session middleware into an Express app.
• A login endpoint, verifying credentials and creating a session.
• Protecting routes, middleware that rejects a request with no valid session.

Hands-On

By the end of this module, you’ll have a real login and logout flow, using sessions to protect a route so only a logged-in user can reach it.

Next module: JSON Web Tokens, a stateless alternative to sessions, common for REST APIs.