[LEGIT] Fix - js/clear-text-cookie

[idan-local-integration]

🔍 The problem

Clear text transmission of sensitive cookie
See issue in Legit

🔒 Fix Details

Fixed cleartext transmission of session cookie

The session cookie was configured without the secure flag, allowing it to be transmitted over unencrypted HTTP connections. An attacker performing a man-in-the-middle attack could intercept the session cookie in cleartext and hijack the user's session.

The fix uncomments the cookie configuration block in the session middleware and enables both httpOnly: true (to prevent XSS attacks from accessing the cookie) and secure: true (to ensure the cookie is only transmitted over HTTPS). This prevents the session cookie from being sent over insecure HTTP connections, protecting it from interception.

--- a/server.js
+++ b/server.js
@@ -82,22 +82,20 @@
         secret: cookieSecret,
         // Both mandatory in Express v4
         saveUninitialized: true,
-        resave: true
+        resave: true,
         /*
         // Fix for A5 - Security MisConfig
         // Use generic cookie name
         key: "sessionId",
         */
 
-        /*
         // Fix for A3 - XSS
         // TODO: Add "maxAge"
         cookie: {
-            httpOnly: true
+            httpOnly: true,
             // Remember to start an HTTPS server to get this working
-            // secure: true
+            secure: true
         }
-        */
 
     }));
 

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud