docs: add note on length of secret

closes #919
expressjs · Jan 28, 2024 · e5f19ce · e5f19ce
1 parent 2a7a50b
commit e5f19ce
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -295,6 +295,9 @@ the secret without invalidating sessions, provide an array of secrets, with the
 secret as first element of the array, and including previous secrets as the later
 elements.
 
+**Note** HMAC-256 is used to sign the session ID. For this reason, the secret should
+contain at least 32 bytes of entropy.
+
 ##### store
 
 The session store instance, defaults to a new `MemoryStore` instance.