Express-session的Secret应设为静态还是动态？

Short answer: You absolutely should set secret to a static, long-lived random string—dynamic values like what you're using now will break your session functionality entirely.

Let me break down why your current approach is problematic, and what you should do instead:

Why dynamic secret values are a bad idea #

The secret in express-session is used to sign the session ID cookie sent to the client. This signature ensures the client can't tamper with the session ID (like trying to forge a session for another user).

If you generate a new secret every time your server starts (as your code does with bcrypt.genSaltSync() and hashSync()), every existing user session will become invalid the next time the server restarts. The server will see the old session ID cookie, try to verify its signature with the new secret, fail, and treat that user as not logged in. This leads to constant, unexpected logouts for your users—definitely not what you want for a persistent session system.

The correct approach #

1. Generate a secure, long random string: Aim for at least 32 characters of random letters, numbers, and symbols. You can use Node.js built-in tools like crypto.randomBytes(32).toString('hex') to generate a safe one.
2. Store it securely: Never hardcode this string directly in your code (especially if you're using version control like Git). Instead, use an environment variable (most hosting platforms let you set these securely) or a dedicated, non-committed config file.
3. Use it consistently: Keep this value the same across server restarts and deployments.

Here's a revised version of your code following these rules:

// In production, pull this from an environment variable (e.g., process.env.SESSION_SECRET)
// For local development, you can use a temporary random string (but replace it for production!)
const sessionSecret = process.env.SESSION_SECRET || 'a-very-long-and-random-string-for-dev-only-1234567890';

app.use(session({
    maxAge: toTime("days", 7),
    saveUninitialized: false,
    secret: sessionSecret,
    // Pro tip: For production, add these security settings too
    // secure: true, // Only send cookie over HTTPS
    // httpOnly: true, // Prevent client-side JS from accessing the cookie
    // sameSite: 'strict' // Mitigate CSRF attacks
}));

Bonus: Rotating secrets safely #

If you ever need to change your secret (e.g., if you suspect it's been compromised), you can pass an array of secrets instead of a single string. For example:

secret: ['old-secure-secret', 'new-even-more-secure-secret']

This way, the server will still validate existing sessions signed with the old secret, while new sessions will use the new secret. After a grace period (to let all active sessions expire or be renewed), you can remove the old secret from the array.

内容的提问来源于stack exchange，提问作者A. L