Set `Secure` on Express session cookies

#Metadata

Rule ID

ts.security.express-insecure-cookie

Severity

medium

Confidence

0.9

Languages

javascript, typescript

Presets

recommended, security, strict

Stability

stable

Applies to

block

Tags

authentication, cookies, rules-catalog, security

#Why it matters

Cookies sent over non-HTTPS transport are easier to intercept or replay.

#Remediation

Set `secure: true` and serve the cookie only over HTTPS.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.express-insecure-cookie.rule.yaml.