title: Node.js session login
body: <p>Node.js does not seem to be remembering my session.</p>
  
  <p>I am using Express with <code>cookie-parser</code> and <code>express-session</code> as middleware.</p>
  
  <p>In my application, I use Mongo to keep usernames and passwords.</p>
  
  <p>The following is a MWE:</p>
  
  <pre><code>var express = require('express');
  var cookieParser = require('cookie-parser');
  var session = require('express-session');
  
  var app = express();
  app.use(cookieParser({
      secret: 'derma-aid'
  }));
  app.use(session({
      secret: 'derma-aid',
      resave: false,
      saveUninitialized: false,
      cookie: {secure: false}
  }));
  
  // CORS (Cross-Origin Resource Sharing) headers to support Cross-site HTTP requests
  app.all('*', function(req, res, next) {
      res.header('Access-Control-Allow-Origin', '*');
      res.header('Access-Control-Allow-Headers', 'X-Requested-With');
      next();
  });
  
  app.get('/login', function(req, res)
  {
      console.log('login');
      req.session.user_id = 500;
      res.send('&lt;h1&gt;login&lt;/h1&gt;');
  });
  
  app.get('/view', function(req, res)
  {
      console.log('view id: ' + req.session.user_id);
      res.send('&lt;h1&gt;view: ' + req.session.user_id + '&lt;/h1&gt;');
  });
  
  app.get('/logout', function(req, res)
  {
      console.log('logout: ' + req.session.user_id);
      res.send('&lt;h1&gt;logout: ' + req.session.user_id + '&lt;/h1&gt;');
      delete req.session.user_id;
  });
  
  app.listen(5000);
  </code></pre>
  
  <p>If you go to the browser to <code>http://localhost:5000/login</code>, then <code>req.session.user_id</code> should be set and displayed correctly on <code>http://localhost:5000/view</code>.</p>
  
  <p>But, instead, I am getting undefined messages...</p>
  
  <p><strong>EDIT:</strong> <code>cookie: {secure: false}</code> as suggested by @tiblu. I get this error: <code>TypeError: Secret string must be provided.</code>.</p>