It is difficult for me to fully understand this whole process.

I am using express.js and express-session.js with Node.

Now if someone logs in, a session is stored in the session store(server side) and as a cookie (client side).

Besides other configuration options, there is:

my session name is : 'session_ID'
and the secret is : 'secret' (*just for this demonstration*)

Example: Server side-> Store: sess:II3l_VBObKhFSN_qo3cu5mL5bjZzCJwL :{\"cookie\":{\"originalMaxAge\":300000,\"expires\":\"2019-04-11T18:42:22.104Z\",\"secure\":false,\"httpOnly\":true,\"path\":\"/\",\"sameSite\":true},\"userId\":\"5cad03dbba90381e7a1c150f\"}

Client side-> Cookie: (see Screenshot)

Now the value of the cookie is the following:


I know that s%3 is some kind of prefix

then there is the sessionId: AII3l_VBObKhFSN_qo3cu5mL5bjZzCJwL

and the last thing after the dot (.): 1d1i6LfkW%2F%2BcrkvDvJqsPTvybmNenEaMgj87vTRrYVY

So correct me if I am wrong but my assumption is:

the sessionID is long enough so it will be safe against bruteforcing a right sessionID and logging in as someone else.

If a client sends a request with the cookie, I can get his data from the session store (here it would be the userId) and make decisions based on that.

So what is the thing after the dot? 1d1i6LfkW%2F%2BcrkvDvJqsPTvybmNenEaMgj87vTRrYVY

Why do I need a secret?

EDIT (as advised by Xander not to do it by an answer):

Okay, what I could have done before asking this question here is just try it out. So I opened two browser B1 and B2.

In B1 I logged in as User1 and in B2 as User2. I have a query where i get the current User.

So I took the session ID of User1 of B1 and replaced it with User2 of B2 and made a query to get the current User -> What I got was no User.

So the assumption of me was wrong.

Is there a helpful site which explains this? I still don't get how this really works "behind the scences".


The part before the . is a UUID generated here by uid-safe, using a CSPRNG (by default anyway, the session id generation function appears to be configurable). This is a standard random session identifier created using enough entropy to make guessing one impractical.

The part after the . is a "signature" (actually it's a MAC) created here and validated here using cookie-signature. This means that anyone who actually manages to guess a session id (most likely due to someone using their own subpar generation function) won't be able to make use of it without knowing the secret key used for the MAC.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.