Insecure cookie (ARCH3123)

Esta página aún no está disponible en tu idioma.

Key typescript.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies set without the Secure flag can be transmitted over cleartext HTTP and intercepted on the network. Always mark sensitive cookies Secure.

Incorrect

res.cookie("session", token, { httpOnly: true });

res.cookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
});

Set session and auth cookies with secure: true so they are only sent over HTTPS.