A developer uses 'connect.sid' (express-session default) as the cookie name. A security auditor recommends renaming it. Why?

• A.The name connect.sid collides with cookies from other Express apps on the same domain (a common clash on shared hosts), and one app then overwrites the session of another, leaving users logged out at random, with a unique name per application removing that clash since each app reads its own cookie
• B.The dot in connect.sid breaks RFC 6265 parsing (cookie names must be alphanumeric), and some proxies strip the value, since a period is reserved for path separators in cookie headers sent by clients
• C.Default cookie names reveal the technology stack (express-session / Node.js/Connect) to attackers, aiding reconnaissance. Fingerprinting middleware and framework versions helps attackers identify CVEs. Renaming to a generic name provides minimal security through obscurity as one layer
• D.The default name signals the cookie has no Secure flag (a convention of the middleware), and scanners flag it, since a __Host- prefixed name is what enforces the flag in the browser for the cookie