Insecure cookie (ARCH3123)

Key typescript.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies set without the Secure flag can be transmitted over cleartext HTTP and intercepted on the network. Always mark sensitive cookies Secure.

Incorrect

res.cookie("session", token, { httpOnly: true });

Correct

res.cookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
});

Fix

Set session and auth cookies with secure: true so they are only sent over HTTPS.