title: HapiJS user session management
body: <p>Below code is from HapiJS docs and it is describing how to use sessions and cookies by using <em>@hapi/cookie</em> plugin.</p>
  <pre><code>'use strict';
  
  const Hapi = require('@hapi/hapi');
  
  
  const internals = {};
  
  
  // Simulate database for demo
  
  internals.users = [
      {
          id: 1,
          name: 'john',
          password: 'password',
      },
  ];
  
  
  internals.renderHtml = {
      login: (message) =&gt; {
  
          return `
      &lt;html&gt;&lt;head&gt;&lt;title&gt;Login page&lt;/title&gt;&lt;/head&gt;&lt;body&gt;
      ${message ? '&lt;h3&gt;' + message + '&lt;/h3&gt;&lt;br&gt;&lt;/a&gt;' : ''}
      &lt;form method=&quot;post&quot; action=&quot;/login&quot;&gt;
        Username: &lt;input type=&quot;text&quot; name=&quot;username&quot;&gt;&lt;br&gt;
        Password: &lt;input type=&quot;password&quot; name=&quot;password&quot;&gt;&lt;br&gt;&lt;/a&gt;
      &lt;input type=&quot;submit&quot; value=&quot;Login&quot;&gt;&lt;/form&gt;
      &lt;/body&gt;&lt;/html&gt;
        `;
      },
      home: (name) =&gt; {
  
          return `
      &lt;html&gt;&lt;head&gt;&lt;title&gt;Login page&lt;/title&gt;&lt;/head&gt;&lt;body&gt;
      &lt;h3&gt;Welcome ${name}! You are logged in!&lt;/h3&gt;
      &lt;form method=&quot;get&quot; action=&quot;/logout&quot;&gt;
        &lt;input type=&quot;submit&quot; value=&quot;Logout&quot;&gt;
      &lt;/form&gt;
      &lt;/body&gt;&lt;/html&gt;
        `;
      }
  };
  
  
  internals.server = async function () {
  
      const server = Hapi.server({ port: 8000 });
  
      await server.register(require('@hapi/cookie'));
  
      server.auth.strategy('session', 'cookie', {
  
          cookie: {
              name: 'sid-example',
  
              // Don't forget to change it to your own secret password!
              password: 'password-should-be-32-characters',
  
              // For working via HTTP in localhost
              isSecure: false
          },
  
          redirectTo: '/login',
  
          validateFunc: async (request, session) =&gt; {
  
              const account = internals.users.find((user) =&gt; (user.id === session.id));
  
              if (!account) {
                  // Must return { valid: false } for invalid cookies
                  return { valid: false };
              }
  
              return { valid: true, credentials: account };
          }
      });
  
      server.auth.default('session');
  
      server.route([
          {
              method: 'GET',
              path: '/',
              options: {
                  handler: (request, h) =&gt; {
  
                      return internals.renderHtml.home(request.auth.credentials.name);
                  }
              }
          },
          {
              method: 'GET',
              path: '/login',
              options: {
                  auth: {
                      mode: 'try'
                  },
                  plugins: {
                      'hapi-auth-cookie': {
                          redirectTo: false
                      }
                  },
                  handler: async (request, h) =&gt; {
  
                      if (request.auth.isAuthenticated) {
                          return h.redirect('/');
                      }
  
                      return internals.renderHtml.login();
                  }
              }
          },
          {
              method: 'POST',
              path: '/login',
              options: {
                  auth: {
                      mode: 'try'
                  },
                  handler: async (request, h) =&gt; {
  
                      const { username, password } = request.payload;
                      if (!username || !password) {
                          return internals.renderHtml.login('Missing username or password');
                      }
  
                      // Try to find user with given credentials
  
                      const account = internals.users.find(
                          (user) =&gt; user.name === username &amp;&amp; user.password === password
                      );
  
                      if (!account) {
                          return internals.renderHtml.login('Invalid username or password');
                      }
  
                      request.cookieAuth.set({ id: account.id });
                      return h.redirect('/');
                  }
              }
          },
          {
              method: 'GET',
              path: '/logout',
              options: {
                  handler: (request, h) =&gt; {
  
                      request.cookieAuth.clear();
                      return h.redirect('/');
                  }
              }
          }
      ]);
  
      await server.start();
      console.log(`Server started at: ${server.info.uri}`);
  };
  
  
  internals.start = async function() {
  
      try {
          await internals.server();
      }
      catch (err) {
          console.error(err.stack);
          process.exit(1);
      }
  };
  
  internals.start();
  </code></pre>
  <p>My question is: in POST login route, and after a user is successfully logged in, does <code>request.cookieAuth.set({ id: account.id });</code> save the <code>{id:account.id}</code> in memory(cache) and send it as cookie to the client? or there is nothing is saved here?.
  Similarly, does <code>request.cookieAuth.clear();</code> clear the session from memory and from client ??</p>