the default setting session is cookie?
The default setting put session in client cookie, is it safe? As I know cookie work in client and session just put an sessionId in client take session value in server side .  koa-session without store put session value in cookie even if it is encoded but I think all from client is not worthy of trust.