Reason to rename ASP.NET Session Cookie Name?

Below link provides more information about why session cookies should be renamed.

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

"The name used by the session ID should not be extremely descriptive nor offer unnecessary details about the purpose and meaning of the ID.

The session ID names used by the most common web application development frameworks can be easily fingerprinted [0], such as PHPSESSID (PHP), JSESSIONID (J2EE), CFID & CFTOKEN (ColdFusion), ASP.NET_SessionId (ASP .NET), etc. Therefore, the session ID name can disclose the technologies and programming languages used by the web application.

It is recommended to change the default session ID name of the web development framework to a generic name, such as “id”."


1) It might (slightly) slow someone down who is (casually) looking for it.

2) You might want to hide the fact that you are running ASP.NET


If you have several applications running under the same domain on the same server, you may well want to have seperate session cookie names for each one, so that they aren't sharing the same session state or worse still overwriting each other.

See also the notes for the Forms Auth cookie name:

Specifies the HTTP cookie to use for authentication. If multiple applications are running on a single server and each application requires a unique cookie, you must configure the cookie name in each Web.config file for each application.