Fix guide · low · cookie_name_reveals_stack
Cookie name reveals backend framework
What this rule means
Cookie names like JSESSIONID, PHPSESSID, connect.sid, laravel_session, next-auth.session-token fingerprint your backend stack.
Why it matters
Knowing the framework lets an attacker target known CVEs for that framework. Not severe alone, but reduces the time to a successful exploit.
How to fix it
Rename your session cookie. Most frameworks let you customize:
- Express:
session({ name: 'sid', ... }) - Next.js NextAuth: configure a custom cookie name
- Laravel:
'cookie' => 'sid'in config/session.php - Spring:
server.servlet.session.cookie.name=SIDin application.properties
Pick something generic. Any short name works.
Did vibecheck flag this on your app?
If you reached this page from a vibecheck inspection report, the redacted match in your scan output is the exact string we found in your bundle. After applying the fix above, run the inspection again — the finding should clear.
Run another inspection