在express.js api response

Question

我正在使用express js开发REST api。即使我没有编写任何特定于会话的代码，但在api响应中connect.sid cookie似乎已经设置好了。这是express.js的默认行为吗？我计划使用基于令牌的身份验证机制，所以我想完全禁用它。有没有完全禁用它的选项？

app.use(bodyParser.urlencoded({
    extended: true
}));
app.use(bodyParser.json());
app.use(methodOverride());

app.use(cors());
app.use(function (req, res, next) {

    // Website you wish to allow to connect
    res.setHeader('Access-Control-Allow-Origin', '*');

    // Request methods you wish to allow
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, DELETE');

    // Request headers you wish to allow
    res.setHeader('Access-Control-Allow-Headers', 'origin, x-requested-with, content-type, accept, x-xsrf-token');

    // Set to true if you need the website to include cookies in the requests sent
    // to the API (e.g. in case you use sessions)
    res.setHeader('Access-Control-Allow-Credentials', true);

    // Pass to next layer of middleware
    next();
});

// CookieParser should be above session
app.use(cookieParser());

// Express MongoDB session storage
app.use(session({
    saveUninitialized: false,
    resave: true,
    secret: config.sessionSecret,
    store: new mongoStore({
        db: db.connection.db,
        collection: config.sessionCollection
    })
}));

// use passport session
app.use(passport.initialize());
app.use(passport.session());