Session Identifier Stored in Cookie during Logout

[tianjk99]

Please check if there is any problem.
The code in the file "user.js" at the path "innovate-digital-bank/portal/routes" includes a logout endpoint ("/endpoints/logout") that stores the session identifier (sid) in a cookie during the logout process. While this approach may not pose an immediate security risk, it is important to address potential vulnerabilities and follow security best practices.
res.cookie("connect.sid", "", {expires: new Date()});
Currently, the code clears the "connect.sid" cookie and destroys the session. However, it does not generate a new session identifier after the logout, which could leave the application vulnerable to session fixation attacks. In a session fixation attack, an attacker could obtain the session identifier before the session is destroyed and use it to impersonate the user.
It is advisable to implement secure cookie options by setting the "Secure" flag to true to ensure the cookie is only transmitted over HTTPS, and the "HttpOnly" flag to true to prevent client-side script access to the cookie.