title: Why is express-session connect.sid value is visible on client?
body: <p>I was playing around with express-session and reading their documentation and it seems like on the client side, the cookie with the name <code>connect.sid</code> stores the session ID. My understanding of security is limited but isn't this a vulnerability if the session ID is so easily accessible?</p>
  
  <p><a href="https://i.stack.imgur.com/VJczF.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VJczF.png" alt="enter image description here"></a></p>