const express = require('express');
const app = express();

app.get('/login', (req, res) => {
  // In a real application, successful authentication would precede this.
  const sessionToken = 'your_secure_session_token_here';

  res.cookie('session_id', sessionToken, {
    httpOnly: true, // Prevents client-side JavaScript access
    secure: true,   // Ensures cookie is only sent over HTTPS
    sameSite: 'Lax', // Protects against CSRF (alternatives: 'Strict', 'None')
    maxAge: 3600000, // Cookie expiration in milliseconds (e.g., 1 hour)
    // domain: '.yourdomain.com', // Uncomment if needed for subdomains
    // path: '/', // Defaults to '/', set if specific paths are needed
  });

  res.send('Login successful! Session cookie set.');
});

app.get('/', (req, res) => {
  res.send('Welcome! Check your cookies.');
});

const PORT = 3000;
app.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}. Use HTTPS in production!`);
  console.log('Access /login to set a secure cookie.');
});