title: Node JS, express-session, remove cookie from client browser
body: <p>I work with app, that already has its own infrastructure. The task is to prevent user login in several browser. Our application has single app architecture, so ideally user should work only in one browser tab. And I have a problem. I can’t remove cookie from client.</p>
  
  <p>I. Briefly.</p>
  
  <p>App settings:</p>
  
  <p>Server: NodeJS
  Port: 8083</p>
  
  <p>Client: VueJS
  Port: 8088</p>
  
  <p>I use module <code>express-session</code> to initialize session mechanism on server side and send cookies to client. Client hasn’t set cookies.</p>
  
  <p>II. Details:</p>
  
  <p>Server’s root file is <strong>index.js</strong></p>
  
  <p>I do the following in it: </p>
  
  <ol>
  <li>Plug in <code>express</code> module: </li>
  </ol>
  
  <pre><code>const express = require('express')
  </code></pre>
  
  <ol start="2">
  <li>Plug in <code>cors</code> module:</li>
  </ol>
  
  <pre><code>const cors = require('cors')
  </code></pre>
  
  <ol start="3">
  <li>Add <code>cors</code> settings: </li>
  </ol>
  
  <pre><code>app.use(cors({
      origin: 'http://localhost:8088',
      credentials: true
  }))
  </code></pre>
  
  <p>Then I initialize session in <strong>user.js</strong> file and receive client’s connects:</p>
  
  <ol>
  <li>Plug in <code>express-session</code> module:</li>
  </ol>
  
  <pre><code>const session = require('express-session')
  </code></pre>
  
  <ol start="2">
  <li>Plug in routing by <code>express.Router()</code>:</li>
  </ol>
  
  <pre><code>const router = express.Router()
  </code></pre>
  
  <ol start="3">
  <li>Add session settings:</li>
  </ol>
  
  <pre><code>const EIGHT_HOURS  = 1000 * 60 * 60 * 8
  const {
      SESS_NAME = 'sid',
      SESS_LIFETIME = EIGHT_HOURS,
      SESS_SECRET = 'test',
      NODE_ENV = 'development'
  } = process.env
  const IN_PROD = NODE_ENV === 'production'
  </code></pre>
  
  <ol start="4">
  <li>Initialize session:</li>
  </ol>
  
  <pre><code>router.use(session({
      name: SESS_NAME,
      resave: false,
      saveUninitialized: false,
      secret: SESS_SECRET,
      cookie: {
          maxAge: SESS_LIFETIME,
          sameSite: false,
          // Must have HTTPS to work 'secret:true'
          secure: IN_PROD
      }
  }))
  </code></pre>
  
  <ol start="5">
  <li>Receive client queries by <code>router.post()</code></li>
  </ol>
  
  <p>So what I did:</p>
  
  <ol>
  <li>I use <code>req.session.destroy</code> to remove session data and expect the browser logout user from certain browser and cookies clear.</li>
  </ol>
  
  <pre><code>req.session.destroy(err =&gt; {
              if (err) {
                  return res.send({ error: 'Logout error' })
              }
              res.clearCookie(SESS_NAME, {path: '/'})
              return res.send({ 'clearSession': 'success' })
          })
  </code></pre>
  
  <p>Unfortunately nothing magic happens</p>
  
  <ol start="2">
  <li><p>I read different topics. For example, here (<a href="https://github.com/expressjs/session/issues/507" rel="nofollow noreferrer">GitHub</a>) offer the conclusion: use explicit cookie’s path indication in <code>res.clearCookie</code> method as shown above.
  That didn’t work.</p></li>
  <li><p>Wrote this setting <code>{path: '/'}</code> in cookies settings. Didn’t work too.</p></li>
  </ol>
  
  <pre><code>router.use(session({
      name: SESS_NAME,
      resave: false,
      saveUninitialized: false,
      secret: SESS_SECRET,
      cookie: {
      path: '/',
          maxAge: SESS_LIFETIME,
          sameSite: false,
          // Must have HTTPS to work 'secret:true'
          secure: IN_PROD
      }
  }))
  </code></pre>
  
  <p>And as wrote in express-session documentation (<a href="https://www.npmjs.com/package/express-session" rel="nofollow noreferrer">NPM:express-session</a>) this path is the default path for cookie storage.</p>
  
  <ol start="4">
  <li>Add <code>req.session = null</code> in req.session.destroy:</li>
  </ol>
  
  <pre><code>req.session.destroy(err =&gt; {
              if (err) {
                  return res.send({ error: 'Logout error' })
              }
              req.session = null
              res.clearCookie(SESS_NAME, {path: '/'})
              return res.send({ 'clearSession': 'success' })
          })
  </code></pre>
  
  <p>That didn’t work</p>
  
  <ol start="5">
  <li><code>delete req.session</code> doesn’t work too.</li>
  </ol>
  
  <p>So, how can I resolve this problem? What should I do?</p>