Set Secure Cookie Attributes Consistently
Add Secure, HttpOnly, SameSite=Strict to every auth cookie so it is not sent over HTTP, not readable by JS, and not included in cross-site requests.
Task
Implement res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); to close a known attack surface before the next security review finds it.
When to use this
A penetration test report flags the missing res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); as a medium-severity finding on a public endpoint.
Prerequisites
- A running application with the vulnerable endpoint
- Access to security headers or middleware config
Steps
1. Configure res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); in the project configuration file with the recommended defaults.
res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 });
Expected output: The configuration is accepted and res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); runs without errors on the first invocation.
2. Run the check locally to verify res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); blocks merge on failure.
- name: Run add secure cookie attributes
run: pnpm test
Expected output: Pull requests with failing res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 }); are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Close the attack surface
Start by measuring the problem. Add Secure, HttpOnly, SameSite=Strict to every auth cookie so it is not sent over HTTP, not readable by JS, and not included in cross-site requests. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run res.cookie(‘session’, token, { secure: true, httpOnly: true, sameSite: ‘strict’, maxAge: 900000 }); against the current codebase and inspect the output before wiring it into CI.
res.cookie('session', token, { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 900000 });Verify and monitor
Once the gate is in place, make failures actionable. A failing res.cookie(‘session’, token, { secure: true, httpOnly: true, sameSite: ‘strict’, maxAge: 900000 }); should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.