Session

// Server-side Session Creation
app.post('/login', (req, res) => {
  const user = authenticate(req.body.username, req.body.password);
  if (user) {
    // Create session
    const sessionId = generateSecureRandomString();
    sessions[sessionId] = {
      userId: user.id,
      createdAt: Date.now(),
      expiresAt: Date.now() + 3600000 // 1 hour
    };
    
    // Set session cookie
    res.cookie('sessionId', sessionId, {
      httpOnly: true,
      secure: true,
      sameSite: 'strict'
    });
    
    res.json({ success: true });
  }
});

// Session Validation Middleware
app.use((req, res, next) => {
  const sessionId = req.cookies.sessionId;
  const session = sessions[sessionId];
  
  if (!session || session.expiresAt < Date.now()) {
    return res.status(401).json({ error: 'Session expired' });
  }
  
  req.user = getUserById(session.userId);
  next();
});