What is the connect.sid cookie?
connect.sid is the standard cookie used by the express-session package, the most widely used session-management middleware for applications built with Express.js (a Node.js framework). It is not a third-party cookie — it is set directly by the web application itself, from the server (an HTTP cookie, not JavaScript-based).
It appears as soon as a visitor loads a page of an Express application with express-session enabled — for example, when logging in, adding a product to a cart, or filling out a multi-step form.
What data it stores
The cookie value is a cryptographically signed session identifier (it typically starts with the s%3A prefix, the URL-encoded form of the signature). This ID does not directly contain personal data; it is simply a key the server uses to look up the actual session data, which is stored separately — on the server or in an external store (database, Redis, etc.).
The actual session data (e.g. login status, cart contents) stays on the server and is not visible in the cookie value itself. The cookie is sent to the domain of the Express application that issued it, with every subsequent request.
What it is used for
Its purpose is strictly functional: it keeps track of a visitor's "state" across multiple HTTP requests, which are otherwise stateless by nature. Without this cookie, the application couldn't recognize a logged-in user on the next page, or remember shopping cart contents between pages.
It is used solely by the site/application running on Express, not by an external advertising or analytics provider.
Does it require consent?
connect.sid is generally classified as a strictly necessary cookie, since it supports functionality explicitly requested by the user (login, cart, forms) without which the service cannot work properly.
- Under Article 5 of Law 506/2004 (Romania's transposition of the ePrivacy Directive) and ANSPDCP guidance, strictly necessary cookies do not require prior consent.
- Website operators must still list it in the cookie policy, along with its purpose and actual expiry.
- If express-session is configured to also store tracking or marketing-related data (uncommon but possible), the correct classification may shift to "preferences" or "statistics," requiring GDPR-compliant consent.
How to block or delete connect.sid
A visitor can delete or block this cookie from their browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management). Blocking it will log the user out or reset any active session (e.g. an emptied cart, forced logout).
For site administrators, if this cookie is used beyond strictly necessary functionality (for instance combined with tracking features), it should be placed in a consent-required category and blocked until acceptance via a CMP such as CookieFix, which can automatically stop the relevant scripts until the visitor makes a choice.
Frequently asked questions
It's the session cookie generated by the express-session middleware for Node.js applications built with Express, used to maintain a visitor's state (e.g. login) across requests.
No, in its standard configuration it's a technical cookie used for the application to function, not for advertising or behavioral analysis.
Usually not, since it's classified as strictly necessary, but it must still be listed in the site's cookie policy.
It's typically a session cookie, deleted when the browser closes, though its duration can be customized by the developer via express-session configuration.