Why are s: and hmac necessary in the express session cookie?

[jun-gyu]

Why are s: and hmac necessary in the express session cookie?

[wesleytodd]

Ah I hit send early. I should have mentioned that we don't really offer technical support here. This discussions repo is more about the project discussing direction, feature work, and bugs fixes. You might want to ask on a place like StackOverflow or Reddit where more people are there to share opinions and help out.

[wesleytodd]

It has been a while since I have looked at that package, but IIRC those are added using secure cookies and the point is so the middleware can know it should and then check the it's integrity. I would recommend using just one things to create and manage sessions, so maybe you could have the php side make an api request to validate the session and/or fetch it's data from redis?