# How to Access Cookie Values in Express Using the Cookie-Parser Middleware

> Learn how to access cookie values in Express using cookie-parser. Easily read unsigned and signed cookies directly in your route handlers for efficient web development.

- Repository: [expressjs/express](https://github.com/expressjs/express)
- Tags: how-to-guide
- Published: 2026-02-21

---

**Use the `cookie-parser` middleware to populate `req.cookies` for unsigned values and `req.signedCookies` for signed values, then read them directly in your route handlers.**

Express does not parse cookies natively. To access cookie values within your application, you must integrate the community-maintained `cookie-parser` middleware, which extends the request object with convenient properties for reading both standard and cryptographically signed cookies. This guide demonstrates how to install, configure, and use the middleware based on the official `expressjs/express` repository implementation.

## Understanding the Cookie-Parser Middleware

### What Express Doesn’t Do Natively

The core Express framework, as implemented in [`lib/express.js`](https://github.com/expressjs/express/blob/main/lib/express.js) and [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js), handles routing and middleware composition but deliberately excludes cookie parsing logic. Incoming HTTP requests contain cookies in the raw `Cookie` header as semicolon-delimited key-value pairs, but without middleware, the `req` object provides no convenient interface to access these values.

### How the Middleware Extends the Request Object

When you register `cookie-parser`, it attaches a function to the middleware stack that executes on every incoming request. This function:

1. Reads the `Cookie` header from the HTTP request.
2. Parses each `key=value` pair, decodes URL-encoded values, and populates `req.cookies` with an object map.
3. If a secret is provided during middleware registration, it verifies signatures on cookies prefixed with `s:` and places verified values in `req.signedCookies`.
4. Stores the secret on `req.secret` for use by `res.cookie` when signing outgoing cookies, as implemented in [`lib/response.js`](https://github.com/expressjs/express/blob/main/lib/response.js).

## Installing and Configuring Cookie-Parser

Install the middleware via npm:

```bash
npm install cookie-parser

```

Register the middleware in your application entry point before your route handlers:

```javascript
const express = require('express');
const cookieParser = require('cookie-parser');

const app = express();

// Register cookie-parser without a secret for unsigned cookies only
app.use(cookieParser());

// Or provide a secret to enable signed cookie verification
app.use(cookieParser('my-secret-key'));

```

### Handling Signed Cookies

When you provide a secret string to `cookieParser()`, the middleware enables signature verification. Signed cookies contain a cryptographic signature appended to the value, allowing your server to detect tampering. The secret you provide is stored on each request object as `req.secret`, which `res.cookie` later uses to sign new cookies, as seen in [`lib/response.js`](https://github.com/expressjs/express/blob/main/lib/response.js).

## Accessing Cookie Values in Route Handlers

Once the middleware is active, you can access cookie values directly in any route handler.

### Reading Unsigned Cookies with req.cookies

The `req.cookies` object contains key-value pairs for all standard cookies. Access values using standard object notation:

```javascript
app.get('/greet', (req, res) => {
  const username = req.cookies.username || 'guest';
  res.send(`Hello, ${username}!`);
});

```

This reads the `username` cookie set by the client. If the cookie was URL-encoded, `cookie-parser` automatically decodes the value before placing it in `req.cookies`.

### Reading Signed Cookies with req.signedCookies

For cookies that were cryptographically signed (typically set with `res.cookie` using the `signed: true` option), use `req.signedCookies`. The middleware verifies the signature against the secret provided during registration. If verification fails (indicating tampering), the cookie is not added to `req.signedCookies`:

```javascript
app.get('/dashboard', (req, res) => {
  const userId = req.signedCookies.userId;
  
  if (!userId) {
    return res.status(401).send('Invalid or missing signed cookie');
  }
  
  res.send(`Dashboard for user ${userId}`);
});

```

According to the test suite in [`test/req.signedCookies.js`](https://github.com/expressjs/express/blob/main/test/req.signedCookies.js), if you attempt to read signed cookies without providing a secret to the middleware, the verification step is skipped and the cookies remain inaccessible through `req.signedCookies`.

## Setting and Clearing Cookies

While `cookie-parser` handles incoming cookies, Express provides built-in methods for outgoing cookies in [`lib/response.js`](https://github.com/expressjs/express/blob/main/lib/response.js). The `res.cookie()` method serializes values and optionally signs them:

```javascript
// Set an unsigned cookie
res.cookie('username', 'Alice', { maxAge: 900000, httpOnly: true });

// Set a signed cookie (requires cookie-parser with secret)
res.cookie('userId', '12345', { signed: true, httpOnly: true });

```

To remove cookies, use `res.clearCookie()`, which sends a `Set-Cookie` header with an expiration date in the past:

```javascript
res.clearCookie('username');
res.clearCookie('userId', { path: '/admin' }); // Must match path used when setting

```

## Summary

- Express does not parse cookies natively; you must install the `cookie-parser` middleware via `npm install cookie-parser`.
- Register the middleware with `app.use(cookieParser([secret]))` before your routes to populate `req.cookies` and optionally `req.signedCookies`.
- Access unsigned cookie values through `req.cookies` and signed values through `req.signedCookies` in any route handler.
- Provide a secret to the middleware to enable signature verification; the secret is stored in `req.secret` and used by `res.cookie()` when setting signed cookies.
- Use `res.cookie()` and `res.clearCookie()` (implemented in [`lib/response.js`](https://github.com/expressjs/express/blob/main/lib/response.js)) to manage outgoing cookies.

## Frequently Asked Questions

### Do I need cookie-parser to read cookies in Express?

Yes. The core Express framework, as seen in the `expressjs/express` repository, does not include cookie parsing logic. Without the `cookie-parser` middleware, the `Cookie` header remains a raw string and `req.cookies` is undefined. You must install and register `cookie-parser` to access parsed cookie values.

### What is the difference between req.cookies and req.signedCookies?

`req.cookies` contains standard key-value pairs for unsigned cookies, while `req.signedCookies` contains values that have been cryptographically signed to prevent tampering. According to the test file [`test/req.signedCookies.js`](https://github.com/expressjs/express/blob/main/test/req.signedCookies.js), signed cookies are verified against the secret provided to the middleware; if verification fails, the cookie does not appear in `req.signedCookies`.

### How do I set a signed cookie in Express?

Use `res.cookie()` with the `signed: true` option, but only after registering `cookie-parser` with a secret. For example: `res.cookie('userId', '12345', { signed: true, httpOnly: true })`. The middleware stores the secret in `req.secret`, which `res.cookie` (implemented in [`lib/response.js`](https://github.com/expressjs/express/blob/main/lib/response.js)) uses to generate the signature.

### Where is the cookie secret stored in the request object?

The secret provided to `cookieParser()` is stored in `req.secret` on every incoming request. This property is used internally by `res.cookie()` when signing outgoing cookies and by the middleware itself when verifying incoming signed cookies in `req.signedCookies`.