Serve static assets before session middleware
Static assets should be mounted before session middleware when they do not need session state.
#Metadata
#Why it matters
Serving public assets after session middleware broadens the session surface and adds unnecessary auth-state handling to static traffic.
#Remediation
Mount `express.static()` before session middleware unless the static path genuinely requires session state.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.express-static-assets-after-session.rule.yaml.