swap session store to redis

apps/backend/package.json

@@ -23,6 +23,7 @@
   },
   "dependencies": {
     "bcrypt": "^6.0.0",
+    "connect-redis": "^10.0.0",
     "cors": "^2.8.6",
     "database": "workspace:*",
     "dotenv": "^17.4.2",
@@ -30,6 +31,7 @@
     "express-session": "^1.19.0",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
+    "redis": "^6.2.1",
     "zod": "^4.5.4"
   }
 }

apps/backend/src/index.ts

@@ -8,6 +8,8 @@ import session from "express-session";
 import passport from "passport";
 import bcrypt from "bcrypt";
 import env from "./utils/env.js";
+import { RedisStore } from "connect-redis";
+import { createClient, RedisClient } from "redis";
 import { Strategy as LocalStrategy } from "passport-local";
 import { prisma } from "database";
 import { ZodError } from "zod";
@@ -16,6 +18,10 @@ import { ZodError } from "zod";
 import usersRoute from "./routers/users.js";
 import postsRoute from "./routers/posts.js";
 
+// redis client for session mgmt
+const redisClient = createClient({ url: env.REDIS_URL });
+redisClient.connect().catch(console.error);
+
 const app = express();
 app.use(express.urlencoded({ extended: false }));
 app.use(express.json());
@@ -58,9 +64,16 @@ passport.deserializeUser(async (id: number, done) => {
 
 app.use(
   session({
+    store: new RedisStore({ client: redisClient, prefix: "sess:" }),
     secret: env.SESSION_SECRET,
     resave: false,
     saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: env.NODE_ENV === "production",
+      maxAge: 1000 * 60 * 60 * 24 * 7,
+    },
   }),
 );
 app.use(passport.session());

apps/backend/src/utils/env.ts

@@ -6,6 +6,7 @@ const env = z.object({
   PORT: z.coerce.number().default(3000),
   DATABASE_URL: z.string().default("file:../../dev.db"),
   SESSION_SECRET: z.string(),
+  REDIS_URL: z.string().default("redis://localhost:6379"),
 });
 
 export default env.parse(process.env);