Home›Redis in 5 Days›Day 3
Day 3 of 5
⏱ ~60 minutes
Redis in 5 Days — Day 3

Sessions and Auth

Store user sessions in Redis, implement remember-me tokens, share sessions across multiple app instances.

Why Redis for Sessions

By default, Express stores sessions in memory. That works for one server. The moment you have two servers behind a load balancer, sessions don't work — requests hit different servers and only one has the session. Redis fixes this.

Express + Redis sessions
npm install express-session connect-redis redis

import session from 'express-session';
import RedisStore from 'connect-redis';
import { createClient } from 'redis';

const redisClient = createClient({ url: process.env.REDIS_URL });
await redisClient.connect();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    maxAge: 24 * 60 * 60 * 1000  // 24 hours
  }
}));

// Login: store user in session
app.post('/login', async (req, res) => {
  const user = await authenticateUser(req.body);
  req.session.userId = user.id;
  req.session.role = user.role;
  res.json({ success: true });
});
Manual token storage (for APIs)
// For JWTs with revocation support
// Blacklist: store invalidated tokens until they expire
async function logout(token) {
  const decoded = jwt.decode(token);
  const ttl = decoded.exp - Math.floor(Date.now() / 1000);
  if (ttl > 0) {
    await redis.setEx(`blacklist:${token}`, ttl, '1');
  }
}

async function isTokenBlacklisted(token) {
  return await redis.exists(`blacklist:${token}`) === 1;
}
📝 Day 3 Exercise
Implement Session-Based Auth
  1. R
  2. e
  3. p
  4. l
  5. a
  6. c
  7. e
  9. i
  10. n
  11. -
  12. m
  13. e
  14. m
  15. o
  16. r
  17. y
  19. s
  20. e
  21. s
  22. s
  23. i
  24. o
  25. n
  26. s
  28. w
  29. i
  30. t
  31. h
  33. R
  34. e
  35. d
  36. i
  37. s
  39. s
  40. e
  41. s
  42. s
  43. i
  44. o
  45. n
  46. s
  47. .
  49. T
  50. e
  51. s
  52. t
  54. b
  55. y
  57. l
  58. o
  59. g
  60. g
  61. i
  62. n
  63. g
  65. i
  66. n
  67. ,
  69. r
  70. e
  71. s
  72. t
  73. a
  74. r
  75. t
  76. i
  77. n
  78. g
  80. t
  81. h
  82. e
  84. s
  85. e
  86. r
  87. v
  88. e
  89. r
  91. (
  92. o
  93. r
  95. u
  96. s
  97. i
  98. n
  99. g
  101. t
  102. w
  103. o
  105. s
  106. e
  107. r
  108. v
  109. e
  110. r
  112. i
  113. n
  114. s
  115. t
  116. a
  117. n
  118. c
  119. e
  120. s
  121. )
  122. ,
  124. a
  125. n
  126. d
  128. c
  129. o
  130. n
  131. f
  132. i
  133. r
  134. m
  135. i
  136. n
  137. g
  139. t
  140. h
  141. e
  143. s
  144. e
  145. s
  146. s
  147. i
  148. o
  149. n
  151. p
  152. e
  153. r
  154. s
  155. i
  156. s
  157. t
  158. s
  159. .

Day 3 Summary

  • Redis sessions work across multiple server instances — required for horizontal scaling.
  • connect-redis is the Express session store. One line to switch from memory to Redis.
  • Set httpOnly: true and secure: true (in prod) on session cookies always.
  • Token blacklisting: store invalidated JWTs in Redis with TTL = remaining lifetime.
→
← Previous
Day 2: Caching Patterns
Next →
Day 4: Pub/Sub and Streams
→
Finished this lesson?