security.misconfiguration

Serve static assets before session middleware

Static assets should be mounted before session middleware when they do not need session state.

#Metadata

#Why it matters

Serving public assets after session middleware broadens the session surface and adds unnecessary auth-state handling to static traffic.

#Remediation

Mount `express.static()` before session middleware unless the static path genuinely requires session state.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.express-static-assets-after-session.rule.yaml.