Example if you run:
console.log('Connect.sid', req.headers.cookie);
Result of connect.sid value:
connect.sid=s%3A04x6YVZX68nRrhakd3SWuIMakDhuGptO.kyBVHe0HDI4pW1JeOl0xEopRYgQ51ZVlAKdfui7ii18
And if you log the req.sessionID the result is going to be this:
04x6YVZX68nRrhakd3SWuIMakDhuGptO
At the moment I have clear that the first part of the cookie session(connect.sid) is the sessionId. That anyone can build with the genid function that express-session provides us.
To be more in context, I have some WAF rules, some of those rules are for check SQL Attacks or things like that. Some times(fair away), my web application firewall (In Azure) gets fired cause match a pattern in the connect.sid cookie.
I need to handle whole the cookie but I'm only be able to interact with the first section of the cookie value (The sessionID). And here's where I have some questions:
- What is this second value?
- How can I handle it?
- Is possible to delete it and create a new one if the pattern match?
- Am I making a lot of trouble with this? Is it better only to add an exception to the WAF?
Just in case, I was reading this very similar question "express-session - the difference between session id and connect.sid?", but I need more detail about it.