Working with Cookies

import cookieParser from "cookie-parser";
app.use(cookieParser(env.COOKIE_SECRET));   // string or array of strings (rotation)

const lang = req.cookies.lang || "en";
const userId = req.signedCookies.userId;  // false if signature invalid

res.cookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
  maxAge: 1000 * 60 * 60 * 24 * 7,  // 7 days
  path: "/",
  domain: ".example.com"
});

res.clearCookie("session", { path: "/", domain: ".example.com" });

res.cookie("userId", String(user.id), {
  signed: true,
  httpOnly: true,
  sameSite: "lax",
  secure: true
});

const userId = req.signedCookies.userId;
if (userId === false) return res.status(401).json({ error: "Tampered cookie" });