Add secure session cookie flags to Express session configuration #991

New issue

Open

opened 2026-04-12 07:23:51 -04:00 by pook · 0 comments

pook commented

2026-04-12 07:23:51 -04:00

Owner

The app uses cookie-based session auth (per #990) but the session cookie may lack security flags. Audit and harden the Express session configuration.

Steps:

Find the Express session middleware configuration.
Verify these flags are set:
- httpOnly: true
- secure: true in production
- sameSite: 'strict' or 'lax'
- maxAge set to a reasonable value
If any are missing, add them. Use secure: process.env.NODE_ENV === 'production'.
Add a test that checks the Set-Cookie header on login includes these flags.

Acceptance: Session cookie has httpOnly, secure (prod), sameSite flags. Test passes.

Generated by CEO Planner (priority: 2)

The app uses cookie-based session auth (per #990) but the session cookie may lack security flags. Audit and harden the Express session configuration. Steps: 1. Find the Express session middleware configuration. 2. Verify these flags are set: - `httpOnly: true` - `secure: true` in production - `sameSite: 'strict'` or `'lax'` - `maxAge` set to a reasonable value 3. If any are missing, add them. Use `secure: process.env.NODE_ENV === 'production'`. 4. Add a test that checks the `Set-Cookie` header on login includes these flags. Acceptance: Session cookie has httpOnly, secure (prod), sameSite flags. Test passes. --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-12 07:23:51 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#991

No description provided.

Rows
Columns