What am I doing wrong? [question] about cookie-session

[dougwilson]

The keys are only used to sign the contents (from the documentation for keys option https://github.com/expressjs/cookie-session/blob/master/README.md#keys), not encrypt the contents. There is no option to encrypt the contents built in, currently.

If you would like the data encrypted, there are three options currently:

1. Use a server side session to store the contents on the server instead of the client.
2. Encrypt the data and set cipher text in req.swssion
3. Make a pull request to add an encryption feature :)

I hope this helps.