title: In Express.js, is it safe to store any data in sessions?
body: <p>I'm used to working solely with cookies. </p>
  
  <p>With cookies, I would save a username and hash and perform a database query on each pageload, to ensure that the user has the correct password. I was about to do the same thing with sessions, when it occurred to me that sessions are not editable by the user. </p>
  
  <p>Theoretically, I could say:</p>
  
  <pre><code>req.session.authenticated = true
  </code></pre>
  
  <p>and just test to see if the user has been authenticated, without rechecking if the password was correct. </p>
  
  <p>Is this safe to do?
  Or is it necessary to store the username and hash?</p>
  
  <p>P.S. I'm using Express 4.8.6 with express-session 1.7.6</p>