Express Session with Upstash Redis - Upstash Documentation

express-session keeps sessions in memory by default. That memory store loses every session when the process restarts, and each server instance has its own copy, so it does not work behind a load balancer. Storing sessions in Redis fixes both.

The session store is connect-redis with the node-redis client.

Step 1: Create a database#

Create a Redis database as described in Getting Started. On the database page, open the Connect section, select the TCP tab and copy the connection string:

rediss://default:YOUR_TOKEN@YOUR_ENDPOINT:6379

Step 2: Create the project#

mkdir express-session-redis && cd express-session-redisnpm init -ynpm install express express-session connect-redis redisnpm pkg set scripts.start="node index.js"

Step 3: index.js#

index.js

const express = require("express");const session = require("express-session");const { RedisStore } = require("connect-redis");const { createClient } = require("redis");const redisClient = createClient({ url: process.env.REDIS_URL });redisClient.on("error", (err) => console.error("Redis error", err));redisClient.connect().catch(console.error);const app = express();app.use(  session({    store: new RedisStore({ client: redisClient, prefix: "myapp:" }),    secret: process.env.SESSION_SECRET || "replace-with-a-long-random-string",    resave: false,    saveUninitialized: false,  }));app.get("/:page", (req, res) => {  const views = req.session.views || {};  const key = `page:${req.params.page}`;  views[key] = (views[key] || 0) + 1;  req.session.views = views;  res.type("text").send(`You viewed /${req.params.page} ${views[key]} times`);});const port = process.env.PORT || 3000;app.listen(port, () => {  console.log(`Server running on port ${port}`);});

Each session is stored as one key with the myapp: prefix. connect-redis sets a TTL (time to live) on the key from the session cookie’s expiry, or one day by default, so Redis deletes old sessions on its own.

Step 4: Run the app#

Put the connection string in a .env file and start the server:

.env

REDIS_URL="rediss://default:YOUR_TOKEN@YOUR_ENDPOINT:6379"SESSION_SECRET="a-long-random-string"

node --env-file=.env index.js

Step 5: Check your work#

Open http://localhost:3000/foo and http://localhost:3000/bar in two different browsers and refresh a few times. Each browser has its own count:

You viewed /foo 1 timesYou viewed /foo 2 timesYou viewed /bar 1 times

Restart the server and refresh again. The counts continue, because the sessions are in Redis.

Deploy#

Set REDIS_URL and SESSION_SECRET as environment variables on your host. See Render, Fly.io or DigitalOcean for host-specific steps.

FAQ#

How do I configure the session cookie?

See the express-session options. For production behind HTTPS, set cookie: { secure: true } and app.set("trust proxy", 1) if a proxy terminates TLS.