New Pull Request Checklist

• I am not disclosing a vulnerability.
• I am creating this PR in reference to an issue.

Issue Description

When Parse Dashboard runs with multiple replicas behind a load balancer without sticky sessions, CSRF token validation fails because session data is stored in memory and not shared between instances. Requests hitting different replicas fail with "CSRF token validation failed."

Closes: #3015

Approach

Added cookieSessionStore option to accept any express-session compatible store (Redis, MongoDB, etc.) for shared session storage across replicas.

Core changes:

• Authentication.js: Accept optional cookieSessionStore in initialize(), pass to express-session config
• app.js: Pass cookieSessionStore from options to Authentication
• server.js: Pass cookieSessionStore from config.data to dashboard options

Documentation:

Added comprehensive documentation in README.md including:

• Explanation of the multi-replica CSRF token issue
• List of suggested session stores (connect-redis, connect-mongo, connect-pg-simple, memorystore)
• Simple JavaScript example using connect-redis with cookieSessionStore
• Important notes about cookieSessionSecret configuration for multi-replica deployments
• Alternative approach using sticky sessions

Example usage:

const express = require('express');
const ParseDashboard = require('parse-dashboard');
const { createClient } = require('redis');
const RedisStore = require('connect-redis').default;

// Instantiate Redis client
const redisClient = createClient({ url: 'redis://localhost:6379' });
redisClient.connect();

// Instantiate Redis session store
const cookieSessionStore = new RedisStore({ client: redisClient });

// Configure dashboard with session store
const dashboard = new ParseDashboard({
  apps: [...],
  users: [...],
}, {
  cookieSessionStore,
  cookieSessionSecret: 'your-secret-key',
});

const app = express();
app.use('/dashboard', dashboard);
app.listen(4040);

Note: The cookieSessionStore option cannot be set via environment variables or CLI arguments as it requires an instantiated object with active connections. It must be configured programmatically.

Backward compatibility: Defaults to in-memory store when not provided, maintaining full backward compatibility with existing deployments.

TODOs before merging

• Add tests
• Add changes to documentation (guides, repository pages, in-code descriptions)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.