A developer uses 'connect.sid' (express-session default) as the cookie name. A security auditor recommends renaming it. Why?

• A.connect.sid is too long and causes HTTP header size issues; the Secure attribute is what prevents JavaScript from reading a cookie, while HttpOnly restricts it to TLS connections; rotating the session ID after login corrupts the browser's cookie jar and is discouraged by OWASP for that reason; the Domain attribute narrows a cookie to exactly one host, while omitting it shares the cookie with every subdomain
• B.The name connect.sid conflicts with browser security policies; cookie prefixes like __Secure- are advisory only, and browsers do not validate the attributes behind them; a cookie with no Expires or Max-Age lives for exactly 24 hours, the default persistent lifetime in every major browser; OWASP recommends localStorage over cookies for session tokens because cookies are visible to network intermediaries even over TLS
• C.Default cookie names reveal the technology stack (express-session / Node.js/Connect) to attackers, aiding reconnaissance. Fingerprinting middleware and framework versions helps attackers identify CVEs. Renaming to a generic name provides minimal security through obscurity as one layer