Docs should describe how to securely generate session secret

[pkrasicki]

Docs should describe how to securely generate session secret and why it's important. I'm mentioning this again, because my other issue #734 was closed, but the problem still remains.

[ghinks]

Thank you for the continued discussion. In general a secure systems would in fact not hard code the secret in the javascript. It would be an environment variable(s) and would not be visible within the repository within which express exists.

The phrase securely generate session secret really does not mean how do I generate a secret but how do I keep the secret. The secret itself being a text string that is not easy to read or remember.

Keeping the secret would involve making sure it was out of the code base, and would involve changing it periodically.

This is actually security advice.

I will make a PR but it is up to you to collaborate with us to determine the correct language.

[ghinks]

#752 has been raised. I would encourage @pkrasicki to review and give feedback

[ghinks]

closing as PR 752 has been raised.