cookie-parser: From Header String to Usable Object

Why it exists

Raw HTTP requests send all cookies as a single, semi-colon delimited string in the Cookie header. Manually parsing this string in every request handler is repetitive and error-prone. cookie-parser was created to centralize this parsing logic into a reusable Express middleware.

The mental model

Think of cookie-parser as a pre-processor for your Express routes. It intercepts each incoming request, finds the raw Cookie header string, translates it into a clean JavaScript object, and attaches it to the request as req.cookies before your own code runs.

How it works

When you add app.use(cookieParser()), the middleware runs on every request. It reads req.headers.cookie, splits it into key-value pairs, and populates req.cookies. If you provide a secret, like app.use(cookieParser('a-secret-string')), it enables signed cookie support. It looks for cookies prefixed with s:, validates their signature against the secret, and if valid, moves them into a separate req.signedCookies object. A cookie that fails this signature validation will have its value set to false in req.signedCookies, indicating tampering. The middleware also supports "JSON cookies" prefixed with j:, automatically parsing them with JSON.parse.

When to use it

Use this middleware in any Express app where you need to read data from cookies. This is fundamental for managing user sessions, storing preferences, or handling authentication tokens. It is a standard component for most stateful web applications built with Express.

When not to use it

Since it's no longer bundled with Express, you must install it explicitly. Some higher-level libraries, like express-session, handle cookie parsing internally. If your only use for cookies is for such a library, you might not need to install and use cookie-parser directly. Always check the dependency's documentation.

One canonical example

After setting up Express and adding app.use(cookieParser('my-secret')), you can set a signed cookie in one route with res.cookie('user', 'admin', { signed: true }). In another route, you can then access this value. The regular req.cookies object will not contain this cookie, but the req.signedCookies object will contain { user: 'admin' }. If a client had tampered with this cookie, req.signedCookies.user would be false.