{"action":"created","issue":{"url":"https://api.github.com/repos/expressjs/session/issues/176","labels_url":"https://api.github.com/repos/expressjs/session/issues/176/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/session/issues/176/comments","events_url":"https://api.github.com/repos/expressjs/session/issues/176/events","html_url":"https://github.com/expressjs/session/issues/176","id":89922105,"number":176,"title":"Why doesn't this module store the raw session ID in the cookie directly?","user":{"login":"alexbooker","id":11927968,"avatar_url":"https://avatars.githubusercontent.com/u/11927968?v=3","gravatar_id":"","url":"https://api.github.com/users/alexbooker","html_url":"https://github.com/alexbooker","followers_url":"https://api.github.com/users/alexbooker/followers","following_url":"https://api.github.com/users/alexbooker/following{/other_user}","gists_url":"https://api.github.com/users/alexbooker/gists{/gist_id}","starred_url":"https://api.github.com/users/alexbooker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexbooker/subscriptions","organizations_url":"https://api.github.com/users/alexbooker/orgs","repos_url":"https://api.github.com/users/alexbooker/repos","events_url":"https://api.github.com/users/alexbooker/events{/privacy}","received_events_url":"https://api.github.com/users/alexbooker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/expressjs/session/labels/discuss","name":"discuss","color":"02d7e1"},{"url":"https://api.github.com/repos/expressjs/session/labels/help%20wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/expressjs/session/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2015-06-21T15:08:35Z","updated_at":"2015-06-21T20:46:43Z","closed_at":null,"body":"I am posting in relation to [this Information Security question](https://security.stackexchange.com/questions/92122/why-is-it-insecure-to-store-the-session-id-in-a-cookie-directly) that reads:\r\n\r\n> \r\nI am learning about [session middleware](https://github.com/expressjs/session). \r\n\r\n> You **have** to supply a `secret` or the middleware complains:\r\n\r\n>```\r\n>app.use(session({\r\n>  secret: \"abc\",\r\n>  resave: false,\r\n>  saveUninitialized: false,\r\n>  store: new MongoStore({\r\n>    mongooseConnection: mongoose.connection\r\n>  })\r\n>}));\r\n>```\r\n>\r\n> I did some investigation and the actual session ID is \r\n>\r\n>   > eKeYlF1DR6AtVkeFZK9vEIHSZT8e0jqZ\r\n>\r\n> But according to the cookie, the session ID is \r\n>  > s%3AeKeYlF1DR6AtVkeFZK9vEIHSZT8e0jqZ.on5ifVE079C4ctKNdkNiJSh8NkQMckjd5fn%2FsxIQWCk\r\n\r\n> I am confused. **Why is it insecure to store the session ID in the cookie directly?** \r\n\r\n> As I understand it, if an attacker can attain this cookie, maybe via XSS or social engineering, the attacker can still hijack the session. I am not sure what the point of the `secret` is. \r\n\r\nAn authoritative member commented on this question:\r\n\r\n> Hi, welcome to Information Security. I'm not sure what makes you think that it is at all insecure to store the user's sessionid in his cookie (as long as you do it right). From what I can tell, you found that some halfbaked js library does something unintuitive. That doesn't mean it is insecure, or that that is the reason for it. You shouldn't be surprised if this is a halfbaked idea...\r\n\r\nThere is even more context in the comments of [this answer](http://security.stackexchange.com/a/92124/79089).\r\n\r\nCan someone here please shed some light on the issue?\r\n\r\nMany thanks."},"comment":{"url":"https://api.github.com/repos/expressjs/session/issues/comments/113955815","html_url":"https://github.com/expressjs/session/issues/176#issuecomment-113955815","issue_url":"https://api.github.com/repos/expressjs/session/issues/176","id":113955815,"user":{"login":"gabeio","id":643410,"avatar_url":"https://avatars.githubusercontent.com/u/643410?v=3","gravatar_id":"","url":"https://api.github.com/users/gabeio","html_url":"https://github.com/gabeio","followers_url":"https://api.github.com/users/gabeio/followers","following_url":"https://api.github.com/users/gabeio/following{/other_user}","gists_url":"https://api.github.com/users/gabeio/gists{/gist_id}","starred_url":"https://api.github.com/users/gabeio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gabeio/subscriptions","organizations_url":"https://api.github.com/users/gabeio/orgs","repos_url":"https://api.github.com/users/gabeio/repos","events_url":"https://api.github.com/users/gabeio/events{/privacy}","received_events_url":"https://api.github.com/users/gabeio/received_events","type":"User","site_admin":false},"created_at":"2015-06-21T20:46:43Z","updated_at":"2015-06-21T20:46:43Z","body":"Sorry, I am not trying to say that signing is bad or good or otherwise. I am just trying to understand both sides here. Looking around at other modules: https://docs.djangoproject.com/en/1.8/topics/http/sessions/#session-serialization states that a leaked signed session can lead to a `remote code execution vulnerability`."}}