We have a few changes required in app.mjs, some of which we've already touched on. We did carefully isolate the Passport module dependencies to routes/users.mjs. The changes required in app.mjs support the code in routes/users.mjs.

It's now time to uncomment a line we told you to comment out way back in Chapter 5, Your First Express Application. The imports for the routing modules will now look as follows:

import { router as index } from './routes/index';
import { router as users, initPassport } from './routes/users';
import { router as notes } from './routes/notes'; 

The User router supports the /login and /logout URL's as well as using Passport for authentication. We need to call initPassport for a little bit of initialization:

import session from 'express-session';
import sessionFileStore from 'session-file-store';
const FileStore = sessionFileStore(session); 
export const sessionCookieName = 'notescookie.sid';

Because Passport uses sessions, we need to enable session support in Express, and these modules do so. The session-file-store module saves our session data to disk so that we can kill and restart the application without losing sessions. It's also possible to save sessions to databases with appropriate modules. A filesystem session store is suitable only when all Notes instances are running on the same server computer. For a distributed deployment situation, you'll need to use a session store that runs on a network-wide service, such as a database.

We're defining sessionCookieName here so it can be used in multiple places. By default, express-session uses a cookie named connect.sid to store the session data. As a small measure of security, it's useful when there's a published default to use a different non-default value. Any time we use the default value, it's possible that an attacker might know a security flaw depending on that default. 

Use the following command to install the modules:

$ npm install express-session@1.15.x session-file-store@1.2.x --save

Express Session support, including all the various Session Store implementations, is documented on its GitHub project page at https://github.com/expressjs/session. 

Add this in app.mjs:

app.use(session({ 
  store: new FileStore({ path: "sessions" }), 
  secret: 'keyboard mouse',
  resave: true,
  saveUninitialized: true,
  name: sessionCookieName
})); 
initPassport(app);

Here we initialize the session support. The field named secret is used to sign the session ID cookie. The session cookie is an encoded string that is encrypted in part using this secret. In the Express Session documentation, they suggest the string keyboard cat for the secret. But, in theory, what if Express has a vulnerability, such that knowing this secret can make it easier to break the session logic on your site? Hence, we chose a different string for the secret just to be a little different and perhaps a little more secure.

Similarly, the default cookie name used by express-session is connect.sid. Here's where we change the cookie name to a non-default name.

The FileStore will store its session data records in a directory named sessions. This directory will be auto-created as needed:

app.use('/', index); 
app.use('/users', users); 
app.use('/notes', notes); 

The preceding are the three routers used in the Notes application.