mediumLogins and sessions

Insecure Cookie Configuration

Authentication cookies are set without security flags.

Why it matters

Without httpOnly, cookies can be stolen via XSS (cross-site scripting). Without secure, cookies are sent over unencrypted HTTP connections. Without sameSite, cookies are sent with cross-origin requests, enabling CSRF attacks. All three flags are essential for session security.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Cookie set without flags
res.cookie('session', token);

The smallest fix

minimal patch
res.cookie('session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  maxAge: 3600000
});

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] at line [the line number] sets an auth cookie without security flags: [the flagged code]. Add httpOnly, secure, and sameSite options to the cookie.

How to check the fix worked

1. Check Set-Cookie headers include HttpOnly flag
2. Check Set-Cookie headers include Secure flag
3. Check Set-Cookie headers include SameSite flag
4. Verify cookies are not accessible via document.cookie

Further reading