the default setting session is cookie?

koajs / session

Simple session middleware for koa

MIT License

902 stars 113 forks source link

the default setting session is cookie? #68

Closed superbogy closed 7 years ago

superbogy commented 7 years ago

The default setting put session in client cookie, is it safe? As I know cookie work in client and session just put an sessionId in client take session value in server side . koa-session without store put session value in cookie even if it is encoded but I think all from client is not worthy of trust.

dead-horse commented 7 years ago

With the default setting, cookies are all signed, which means user can not change(or fake) session from client side, we'll check the sign in the server side.