What a session secret does
Frameworks like Express (with express-session or cookie-session), Koa and Fastify sign session cookies with a secret so users cannot tamper with them. If the secret is weak or leaked, an attacker can create a valid session cookie for any user.
The default here is 48 random letters and digits, about 286 bits of entropy, with no characters that need escaping in .env files, YAML or shell commands.
Rotating without logging everyone out
express-session accepts an array of secrets, and cookie-session an array of keys. The first one signs new cookies and all of them are accepted when verifying, so you can add a new secret at the front, wait for old sessions to expire, then remove the old one.
Frequently asked questions
Can I use the same secret across services?
Only if they really need to share sessions. Otherwise give each service its own secret, so one leak does not affect the others.
Where should the secret live?
In an environment variable such as SESSION_SECRET, loaded when the app starts. Never commit it to your repository.