Handle uploads, sessions, and cookies

The app limits upload size and type, stores files outside public paths, and sends only an opaque session id in a secure cookie. This is a small part of an Express 5 notes application with an HTML interface, a JSON API, sessions, tests, and production failure handling, but the boundary it creates affects everything that follows.

Upload middleware, session stores, and cookie attributes introduce storage and trust decisions beyond ordinary form fields. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to trust an extension, store uploads under a directly served path, or keep production sessions in process memory. It makes later failures harder to locate. Instead, validate content and size, generate server-side names, use a production session store, and configure restrictive cookies. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Accept useful input while keeping parsing, validation, state, and privilege boundaries visible. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Upload valid and deceptive files, restart the server, log out, and verify both file and session behavior. Hand the result to someone else and see whether the behavior is clear without an oral explanation.