How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle?

In session-based authentication, after a successful login the server creates a session record (containing the user's identity and any relevant data) stored server-side, and sends the client only an opaque session ID via a cookie -- each subsequent request includes that cookie, and the server looks up the corresponding session data before processing the request. The session store (in-memory for development, but Redis or a database in production for scalability across multiple server instances) needs to handle expiration, and in-memory stores don't work correctly once an application is scaled horizontally across multiple processes without a shared store.

const session = require('express-session');
const RedisStore = require('connect-redis').default;

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  cookie: { secure: true, httpOnly: true, maxAge: 86400000 },
}));

app.post('/login', (req, res) => {
  req.session.userId = user.id; // stored server-side, keyed by the session ID cookie
  res.json({ success: true });
});