Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier?
expressjs#session library requires a secret, but also says at the begining of the docs:
Session data is not saved in the cookie itself, just the session ID. Session data is stored server-side.
But I don't see any benefit to create an HMAC of an identifier, because this value will be anyway a bearer token for server state.