title: connectJS sessions - secure true vs false
body: <p>Using Express/connectJS and playing around with sessions. The ConnectJS <a href="http://www.senchalabs.org/connect/session.html" rel="nofollow">documentation</a> provides a simple view counter, and this works for me.</p>
  
  <p>However, it stops working if I set the cookie option 'secure:true', like so...</p>
  
  <pre><code>app.use(express.session({key:'NodeJS', secret:'cookie', cookie:{maxAge:3600000, secure:true}})); 
  </code></pre>
  
  <p>What I see is the sessionID is only sent in the request if 'secure:false'.   If 'secure:true', I get a new sessID with every request.</p>
  
  <p>This fails.</p>
  
  <pre><code>Req header - SECURE:TRUE
  Cookie connect.sid=s%3AP2q10tK255KdVcizJMwETG69.IU2idEzOVaCxahdcRoEGhTkUBK%2B1Evxc0boj97nJgHg;
  connect.sess=s%3Aj%3A%7B%7D.opP3ZU2IoVMmmqws%2F5vFGB4s8FNXJ8R6RNZoF4KRNfU
  </code></pre>
  
  <p>This works.</p>
  
  <pre><code>Req header - SECURE:FALSE 
  Cookie connect.sid=s%3AP2q10tK255KdVcizJMwETG69.IU2idEzOVaCxahdcRoEGhTkUBK%2B1Evxc0boj97nJgHg;
  connect.sess=s%3Aj%3A%7B%7D.opP3ZU2IoVMmmqws%2F5vFGB4s8FNXJ8R6RNZoF4KRNfU;
  NodeJS=s%3ArBKqb-Wptr_IJMYW6VzJVu__.2Yc3GL32L%2BHuY4L5RxepdiEirtvbSlIeErWVIHXm4uc
  </code></pre>
  
  <p>Can someone briefly explain what's going on here, or point me to good explanation?</p>
  
  <p>============= <strong>FOLLOW UP</strong> ==============</p>
  
  <p>The session option 'secure' toggles using either http or https.</p>
  
  <p>Now, there are two types of session management: session, and cookieSession. Below is the output from each of these:</p>
  
  <p>SESSION</p>
  
  <pre><code>app.use(express.cookieParser());
  app.use(express.session({key:'NodeJS', secret:'cookie', cookie:{maxAge:3600000, secure:false}}));
  
  === req.sessionID ===
  b1t73i-MjbyPfQaZHo7_0aGn
  
  ==== req.sessionStore ===
  { sessions: { 'b1t73i-MjbyPfQaZHo7_0aGn': '{"cookie":{"originalMaxAge":3600000,"expires":"2013-08-12T19:13:37.169Z","secure":false,"httpOnly":true,"path":"/"},"views":1}' } generate: [Function], _events: { disconnect: [Function], connect: [Function] } }
  
  === req.session ===
  { cookie: { path: '/', _expires: Mon Aug 12 2013 12:13:37 GMT-0700 (PDT), originalMaxAge: 3600000, httpOnly: true, secure: false }, views: 1 }
  
  ==== req.cookies ===
  { NodeJS: 's:b1t73i-MjbyPfQaZHo7_0aGn.RDYYqfFjjAYFry9PmQW/fih+PPMTgNK6uwy5EW372CE', woot: 'woot' }
  
  === req.signedCookies ===
  { swoot: 'swoot' }
  </code></pre>
  
  <p>COOKIESESSION</p>
  
  <pre><code>app.use(express.cookieParser());
  app.use(express.cookieSession({key:'NodeJS', secret:'cookie', cookie:{maxAge:3600000, secure:false}}));
  
  === req.sessionID ===
  undefined
  
  ==== req.sessionStore ===
  undefined
  
  === req.session ===
  { views: 1, cookie: { path: '/', _expires: Mon Aug 12 2013 12:20:16 GMT-0700 (PDT), originalMaxAge: 3600000, httpOnly: true, secure: false } }
  
  ==== req.cookies ===
  { NodeJS: 's:j:{"views":1}.JtWQMoqzLEZBoGSxbxXfyqFJ2KIYyJG9GDSY4rxdVLQ', woot: 'woot' }
  
  === req.signedCookies ===
  { swoot: 'swoot' }
  </code></pre>
  
  <p>SESSION returns objects I can work with, but how should I handle SESSIONCOOKIE?</p>