CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A developer uses 'connect.sid' (express-session default) as the cookie name. A security auditor recommends renaming it. Why?
- A.connect.sid is too long and causes HTTP header size issues
- B.express-session requires custom cookie names for CSRF protection
- C.Default cookie names reveal the technology stack (express-session / Node.js/Connect) to attackers, aiding reconnaissance. Fingerprinting middleware and framework versions helps attackers identify CVEs. Renaming to a generic name provides minimal security through obscurity as one layer
- D.The name connect.sid conflicts with browser security policies
Why C is correct
Default cookie names like 'connect.sid' (express-session), 'PHPSESSID' (PHP), 'JSESSIONID' (Java), and 'ASP.NET_SessionId' immediately identify the server-side technology. While security through obscurity is not sufficient alone, reducing information disclosure is a defense-in-depth measure. It makes fingerprinting harder and is a low-effort change. Combined with suppressing Server/X-Powered-By headers, it creates a lower-profile deployment.
Know someone studying for Web App Fundamentals? Send them this one.