Security finding
The session cookie has its framework's default name
Security Info Severity: Low
Part of the audit Information exposure. Finding id: security.frameworkSessionCookieName.
What it costs you
The name tells anyone which framework or language runs the site, which narrows the flaws worth trying. It changes nothing else; keeping the software up to date matters more.
What to do
Give the session cookie a neutral name in the framework's session settings.
What it checks
- Cookie name reveals the software used
How to fix it
Rename the session cookie
- Find the session settings of [framework] in the application's configuration and set the cookie name to a neutral value, for example id.
- Expect every visitor to be logged out once, because the old cookie is no longer read.
- Do not use the name of another framework; the point is to name none.
How to check: curl -sI [example url] | grep -i '^set-cookie' (no [name])