Session Management

import {
  setAuthCookies,
  getAuthCookies,
  clearAuthCookies,
  refreshTokens,
} from 'authsafe-express';

initAuthSafe({
  // ...
  cookies: {
    prefix: 'myapp', // myapp.id_token, myapp.access_token, etc.
  },
});

function setAuthCookies(
  res: Response,
  tokens: AuthTokens,
  config: AuthSafeConfig,
): void;

import { setAuthCookies } from 'authsafe-express';

app.post('/auth/manual-login', async (req, res) => {
  // Exchange credentials for tokens
  const tokens = await exchangeCredentials(req.body);

  // Store in cookies
  setAuthCookies(res, tokens, {
    clientId: process.env.AUTHSAFE_CLIENT_ID!,
    domain: process.env.AUTHSAFE_DOMAIN!,
  });

  res.json({ success: true });
});

interface AuthTokens {
  /** ID token (JWT) */
  idToken: string;

  /** Access token (JWT) */
  accessToken: string;

  /** Refresh token (opaque) */
  refreshToken?: string;

  /** Token expiration (Unix timestamp in seconds) */
  expiresAt: number;
}

function getAuthCookies(
  req: Request,
  config: AuthSafeConfig,
): AuthTokens | null;

import { getAuthCookies } from 'authsafe-express';

app.get('/auth/check', (req, res) => {
  const tokens = getAuthCookies(req, {
    clientId: process.env.AUTHSAFE_CLIENT_ID!,
    domain: process.env.AUTHSAFE_DOMAIN!,
  });

  if (tokens) {
    res.json({ authenticated: true, expiresAt: tokens.expiresAt });
  } else {
    res.json({ authenticated: false });
  }
});

function clearAuthCookies(res: Response, config: AuthSafeConfig): void;

import { clearAuthCookies } from 'authsafe-express';

app.post('/auth/clear-session', (req, res) => {
  clearAuthCookies(res, {
    clientId: process.env.AUTHSAFE_CLIENT_ID!,
    domain: process.env.AUTHSAFE_DOMAIN!,
  });

  res.json({ message: 'Session cleared' });
});

async function refreshTokens(
  refreshToken: string,
  config: AuthSafeConfig,
): Promise<AuthTokens>;

import {
  refreshTokens,
  getAuthCookies,
  setAuthCookies,
} from 'authsafe-express';

app.post('/auth/manual-refresh', async (req, res) => {
  const tokens = getAuthCookies(req, {
    clientId: process.env.AUTHSAFE_CLIENT_ID!,
    domain: process.env.AUTHSAFE_DOMAIN!,
  });

  if (!tokens?.refreshToken) {
    return res.status(401).json({ error: 'No refresh token' });
  }

  try {
    const newTokens = await refreshTokens(tokens.refreshToken, {
      clientId: process.env.AUTHSAFE_CLIENT_ID!,
      clientSecret: process.env.AUTHSAFE_CLIENT_SECRET!,
      domain: process.env.AUTHSAFE_DOMAIN!,
    });

    setAuthCookies(res, newTokens, {
      clientId: process.env.AUTHSAFE_CLIENT_ID!,
      domain: process.env.AUTHSAFE_DOMAIN!,
    });

    res.json({ success: true });
  } catch (error) {
    res.status(401).json({ error: 'Refresh failed' });
  }
});

import {
  getAuthCookies,
  setAuthCookies,
  clearAuthCookies,
} from 'authsafe-express';

const authConfig = {
  clientId: process.env.AUTHSAFE_CLIENT_ID!,
  clientSecret: process.env.AUTHSAFE_CLIENT_SECRET!,
  domain: process.env.AUTHSAFE_DOMAIN!,
};

// Store tokens after manual authentication
app.post('/auth/custom-login', async (req, res) => {
  const tokens = await customAuthFlow(req.body);

  setAuthCookies(res, tokens, authConfig);
  res.json({ success: true });
});

// Check session status
app.get('/auth/status', (req, res) => {
  const tokens = getAuthCookies(req, authConfig);

  res.json({
    authenticated: !!tokens,
    expiresAt: tokens?.expiresAt,
  });
});

// Clear session
app.post('/auth/clear', (req, res) => {
  clearAuthCookies(res, authConfig);
  res.json({ message: 'Session cleared' });
});

import {
  getAuthCookies,
  refreshTokens,
  setAuthCookies,
} from 'authsafe-express';
import { isTokenExpired, shouldRefreshToken } from 'authsafe-express';

async function autoRefreshMiddleware(req: any, res: any, next: any) {
  const tokens = getAuthCookies(req, authConfig);

  if (!tokens) {
    return next();
  }

  // Check if token needs refresh (expires in < 5 minutes)
  if (shouldRefreshToken(tokens.expiresAt) && tokens.refreshToken) {
    try {
      const newTokens = await refreshTokens(tokens.refreshToken, authConfig);
      setAuthCookies(res, newTokens, authConfig);
    } catch (error) {
      console.error('Auto-refresh failed:', error);
      clearAuthCookies(res, authConfig);
    }
  }

  next();
}

// Apply to all routes
app.use(autoRefreshMiddleware);

import { getAuthCookies } from 'authsafe-express';
import { isTokenExpired } from 'authsafe-express';

app.get('/api/data', (req, res) => {
  const tokens = getAuthCookies(req, authConfig);

  if (!tokens || isTokenExpired(tokens.expiresAt)) {
    return res.status(401).json({
      error: 'Session expired',
      redirect: '/auth/signin',
    });
  }

  res.json({ data: getData() });
});

initAuthSafe({
  clientId: process.env.AUTHSAFE_CLIENT_ID!,
  clientSecret: process.env.AUTHSAFE_CLIENT_SECRET!,
  domain: process.env.AUTHSAFE_DOMAIN!,
  cookies: {
    prefix: 'authsafe',
    secure: true, // HTTPS only
    sameSite: 'lax', // CSRF protection
    domain: '.myapp.com', // Share across subdomains
  },
  session: {
    maxAge: 7 * 24 * 60 * 60, // 7 days
  },
});

initAuthSafe({
  clientId: process.env.AUTHSAFE_CLIENT_ID!,
  clientSecret: process.env.AUTHSAFE_CLIENT_SECRET!,
  domain: process.env.AUTHSAFE_DOMAIN!,
  cookies: {
    secure: false, // Allow HTTP in development
    sameSite: 'lax',
  },
  session: {
    maxAge: 24 * 60 * 60, // 24 hours
  },
});

import cors from 'cors';

app.use(
  cors({
    origin: 'https://yourfrontend.com',
    credentials: true, // Allow cookies
  }),
);

fetch('https://api.yourapp.com/auth/status', {
  credentials: 'include', // Send cookies
});

app.use(cookieParser()); // ✅ Before routes

app.get('/auth/callback', handleCallback);

// Server
app.use(
  cors({
    origin: 'https://frontend.com',
    credentials: true,
  }),
);

// Client
fetch('/api/data', { credentials: 'include' });

cookies: {
  secure: process.env.NODE_ENV === 'production',
}

// ✅ Correct - works for api.app.com and www.app.com
cookies: {
  domain: '.app.com';
}

// ❌ Wrong - only works for exact domain
cookies: {
  domain: 'app.com';
}