Drill 16: Recall — Sessions, validation and security

import argon2 from 'argon2'

const hash = await argon2.hash(password)
const valid = await argon2.verify(hash, candidate)

if (!valid) {
  response.status(401).json({ error: 'INVALID_CREDENTIALS' })
  return
}

response.cookie('session', token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'lax',
  maxAge: 1000 * 60 * 60,
})