Let's install a cookie session into our often service.
So back in my terminal I'm going to make sure I'm inside my off project directory.
I'll then do an NPR install cookie dash session.
We're not going to only install the cookie such library cookie session by default does not have native
title conscripts support.
So we have to install a type definition file to help typescript to understand what is going on inside
of this library.
But to do so we're going to also install at types flash cookie dash session now make sure you got two
S's right there.
I just made a typo right before this video.
I only put in one S and I got an error during the NPR install saying that that package does not does
not exist.
So just double check your spelling.
All right.
So all installed.
Now let's go back over to our code editor inside my OP directory.
I'll find the SLC folder and then the index out to yes file inside there.
So we're going to import cookie session at the top and then wired up to our Express application as a
middleware.
So right after Mongoose I'll do an import cookie session from cookie dash session and then right after
the app use Jason we will add in app use cookie session.
We are going to pass in a configuration object and we are going to add in two different properties to
this thing.
So first remember we're going to disable encryption on this cookie.
We're not going to worry about someone peeking into this thing or anything like that because the Jason
Webb token itself is already encrypted so I going to put signed on here of false.
I'm also going to require that cookies will only be used if a user is visiting our application over
an HTC CPS connection.
That's just a very small security improvements.
So to add that in I'm also going to add secure true like so for a related reason to that.
So with this secured you're right you're requiring that you must be on a HDP connection.
We're also going to change a very small setting on express itself right after we create the Express
app.
We're going to add app dot sets trust proxy is true the recent version may not app not settings but
app set.
That's better.
The reason for this is that traffic is being proximate to our application through ingress engine X Express
is going to see the fact that stuff is being peroxide and by default Express is going to say hey wait
there's a proxy here I don't really trust this each G.P.S. connection.
Long story short we are just adding in this little step right here to make sure that express is aware
that it's behind a proxy of ingress engine X and to make sure that it should still trust traffic as
being secure even though it's coming from that proxy.
That's it for setup.
We're gonna save this file so we have now made sure back in this flow right here that we have the ability
to eventually set a cookie on the response it goes back to a user the blessing we actually have to do
is make sure that we generate that Jason web token and store it inside the cookie.
Let's take a quick pause right here and discuss how we're going to generate that token in just a moment.