How to secure 'io' cookie
Problem
I noticed that socket.io (engine.io to be precise) is setting a non-secure session cookie called 'io' on the URL it is invoked. What is the role of this cookie, is it necessary and if so, can it be secured? We force https:// for all locations where socket.io is running, and could easily set this cookie to secure but I cannot find where.
Unverified for your environment
Select your OS to check compatibility.
1 Fix
Solution: How to secure 'io' cookie
It's not used for anything; you can disable it by setting `cookie: false` in the server options.
Trust Score
4 verifications
- 1
It's not used for anything; you can disable it by setting `cookie: false` in the
It's not used for anything; you can disable it by setting `cookie: false` in the server options.
Validation
Resolved in socketio/socket.io GitHub issue #2276. Community reactions: 7 upvotes.
Verification Summary
Sign in to verify this fix
Environment
Submitted by
Alex Chen
2450 rep