I've seen many variations of this question, but none seemed to solve my issue. I'm trying to set up a Node.js server using Express. Here is my server configuration:

var express = require('express'),

    RedisStore = require('connect-redis')(express);



var app = express();



app.use(express.urlencoded());

app.use(express.json());

app.use(express.cookieParser());

app.use(express.session({

    store: new RedisStore(), 

    secret: APP_SECRET

}));



// Initialize redis connection

var client = redis.createClient();

client.on('connect', function() {

    console.log('Connected to Redis server')

})

client.on('error', function (err) {

    console.log('Error ' + err);

});



// Enable cross-origin resource sharing

app.all('*', function(req, res, next) {

  res.header('Access-Control-Allow-Origin', '*');

  res.header('Access-Control-Allow-Headers', 'X-Requested-With');

  next();

 });



var api = require('./controllers/api.js');



app.post('/login', api.login);

app.get('/auth', api.auth);



app.listen(3000);

And here are some simple routes:

exports.login = function(req, res) {

    var user = new User(req.username, req.password);

    req.session.user = user;

    console.log(req.session.user); //works

    res.json({user:user});

}



exports.auth = function(req, res) {

    console.log(req.session.user); //doesn't work

    res.json(req.session.user);

}

So in my login route, I can print the session variable as expected. But if I visit the auth route after visiting the login route, the session variable is undefined. How can I get Express sessions to work?