thbrown/http-only-cookie-login.js

## http-only-cookie-login.js
// uuidv4 uses a cryptographically secure random number generator
const uuidv4 = require('uuid/v4')

app.use(cookieParser());

app.post('/login',
  function(request, response) {
    passport.authenticate('local'),
    initSecondaryAuthCookie(request, response);
    response.status(204).send();
  }
);

function initSecondaryAuthCookie(request, response) {
  // Make the non-HttpOnly cookie (express-session handles creation of HttpOnly cookie).
  let token = uuidv4();
  response.cookie('secondaryAuthToken', token, {
    maxAge: 500000,
    httpOnly: false,
  });
  // Store this cookie's token in the session
  var sessionData = request.session;
  sessionData.secondaryAuthToken = token;
}