title: Should session ID cookie be signed?
body: <p>I was using the Node library <a href="https://github.com/expressjs/session" rel="noreferrer">https://github.com/expressjs/session</a> and noticed that it requires a secret to be specified for signing the session ID cookie.</p>
  
  <p>If <em>just</em> the session ID is being stored in the cookie, and not any data, what is the use in signing the cookie?</p>
  
  <p>My reasoning is that if someone wanted to modify a session ID cookie, then that's fine if the session ID sufficiently long to prevent brute force attacks. Am I missing something?</p>