Express Insecure Session Configuration

Description

Detects insecure session configuration including weak secrets, insecure cookies, and missing security flags.

What Shoulder detects

Session configuration has security vulnerabilities

How to fix

Configure sessions with secure settings and environment-based secrets.

```javascript
const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    sameSite: 'strict',
    maxAge: 1000 * 60 * 60 * 24
  },
  resave: false,
  saveUninitialized: false
}));
```

Learn more: https://shoulder.dev/learn/javascript/cwe-384/express-session-configuration

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express

References

Documentation ↗ Learn about CWE-384

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=express-insecure-session .