title: How to decode express-session cookies?
body: <p>I isolated the problem, as far as I could, but still cannot solve it.</p>
  
  <p>I created an empty server with loopback, added <code>express-session</code> and <code>body-parser</code>
  middlewares</p>
  
  <pre><code> "session": {
      "express-session": {
        "params": {
          "name": "id",
          "secret": "potato with eyes",
          "httpOnly": "false"
        }
      }
    },
    "auth": {},
    "parse": {
      "body-parser": {},
      "body-parser#json": {},
      "body-parser#urlencoded": {"params": { "extended": true }}
    }
  </code></pre>
  
  <p>Then, I added a pair of methods to <code>root.js.</code>. The first sets <code>session.id</code> to a variable. The second logs it on next request:</p>
  
  <pre><code>module.exports = function (app)
  {
      var cookieParser = require("cookie-parser")
      var router = app.loopback.Router()
      router.post("/login", function (req, res)
      {
          req.session.id = req.body.id
          console.log("Set id to " + req.body.id)
          res.end()
      })
      router.post("/addLead", function (req, res)
      {
          console.log("session", req.session)
          console.log("got id: ", req.session.id)
          console.log("decrypting single id:", cookieParser.signedCookie(req.session.id, "potato with eyes"))
          console.log("cookie! ", req.cookie)
          console.log("cookie parsed:", cookieParser.JSONCookie(req.cookie, "potato with eyes"))
          console.log("cookie parsed:", cookieParser.signedCookie(req.cookie, "potato with eyes"))
          res.status(403).send("You must login first")
      })
      app.use(router)
  }
  </code></pre>
  
  <p>Decryption of cookies fails. Decryption of id does not change it.</p>
  
  <pre><code>Web server listening at: http://localhost:3000
  Browse your REST API at http://localhost:3000/explorer
  Set id to 15
  session Session {
    cookie:
     { path: '/',
       _expires: null,
       originalMaxAge: null,
       httpOnly: true } }
  got id:  XifrUZXLhKcDHYqQwxESQlLQQ6N1j49d
  decrypting single id: XifrUZXLhKcDHYqQwxESQlLQQ6N1j49d
  cookie!  undefined
  cookie parsed: undefined
  cookie parsed: undefined
  </code></pre>
  
  <p>Here is the html I used for testing:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  
  &lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
  &lt;head&gt;
      &lt;meta charset="utf-8" /&gt;
      &lt;title&gt;&lt;/title&gt;
      &lt;script src="https://code.jquery.com/jquery-3.1.0.min.js"
              integrity="sha256-cCueBR6CsyA4/9szpPfrX3s49M9vUU5BgtiJj06wt/s="
              crossorigin="anonymous"&gt;&lt;/script&gt;
  
      &lt;script&gt;
          function log(data)
          {
              console.log(JSON.stringify(data))
          }
          $.post("http://localhost:3000/login", { name: "John Smit", id: 15 }, function (data)
          {
              log(data)
              $.post("http://localhost:3000/addLead", {
                  name: "Anton Berezin", phone: "337225", model: "1234",
                  mark: "Toyota", yearFrom: "2014", yearTo: "2017"
              }, function (data)
              {
                  log(data)
                  alert(JSON.stringify(data))
              })
              .fail(function (error)
              {
                  log(error)
              })
  
          })
          .fail(function(error)
          {
              alert(JSON.stringify(error))
          })
      &lt;/script&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And the archive with a project:
  <a href="http://www.filedropper.com/cookietest" rel="nofollow">http://www.filedropper.com/cookietest</a></p>
  
  <p>I'll appreciate any help</p>
  
  <hr>
  
  <p>Edit:
  tested with <code>req.cookie</code> instead of <code>req.session.cookie</code>. Didn't change output.</p>