mcp-server-semgrep/semgrep-rules/javascript/express/security/audit/express-cookie-settings.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: express-cookie-session-default-name
    message: >-
      Don’t use the default session cookie name
      Using the default session cookie name can open your app to attacks.
      The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      cwe:
      - 'CWE-522: Insufficiently Protected Credentials'
      owasp:
      - A02:2017 - Broken Authentication
      - A04:2021 - Insecure Design
      source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
      category: security
      technology:
      - express
      cwe2021-top25: true
      subcategory:
      - vuln
      likelihood: HIGH
      impact: LOW
      confidence: MEDIUM
      references:
      - https://owasp.org/Top10/A04_2021-Insecure_Design
    patterns:
      - pattern-either:
          - pattern-inside: |
              $SESSION = require('cookie-session');
              ...
          - pattern-inside: |
              $SESSION = require('express-session');
              ...
      - pattern: $SESSION(...)
      - pattern-not-inside: $SESSION(<... {name:...} ...>,...)
      - pattern-not-inside: |
          $OPTS = <... {name:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.name = ...;
          ...
          $SESSION($OPTS,...);
  - id: express-cookie-session-no-secure
    message: >-
      Default session middleware settings: `secure` not set.
      It ensures the browser only sends the cookie over HTTPS.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      cwe:
      - 'CWE-522: Insufficiently Protected Credentials'
      owasp:
      - A02:2017 - Broken Authentication
      - A04:2021 - Insecure Design
      source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
      category: security
      technology:
      - express
      cwe2021-top25: true
      subcategory:
      - vuln
      likelihood: HIGH
      impact: LOW
      confidence: MEDIUM
      references:
      - https://owasp.org/Top10/A04_2021-Insecure_Design
    patterns:
      - pattern-either:
          - pattern-inside: |
              $SESSION = require('cookie-session');
              ...
          - pattern-inside: |
              $SESSION = require('express-session');
              ...
      - pattern: $SESSION(...)
      - pattern-not-inside: $SESSION(<... {cookie:{secure:true}} ...>,...)
      - pattern-not-inside: |
          $OPTS = <... {cookie:{secure:true}} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE = <... {secure:true} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie = <... {secure:true} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE.secure = true;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie.secure = true;
          ...
          $SESSION($OPTS,...);
  - id: express-cookie-session-no-httponly
    message: >-
      Default session middleware settings: `httpOnly` not set.
      It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      cwe:
      - 'CWE-522: Insufficiently Protected Credentials'
      owasp:
      - A02:2017 - Broken Authentication
      - A04:2021 - Insecure Design
      source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
      category: security
      technology:
      - express
      cwe2021-top25: true
      subcategory:
      - vuln
      likelihood: HIGH
      impact: LOW
      confidence: MEDIUM
      references:
      - https://owasp.org/Top10/A04_2021-Insecure_Design
    patterns:
      - pattern-either:
          - pattern-inside: |
              $SESSION = require('cookie-session');
              ...
          - pattern-inside: |
              $SESSION = require('express-session');
              ...
      - pattern: $SESSION(...)
      - pattern-not-inside: $SESSION(<... {cookie:{httpOnly:true}} ...>,...)
      - pattern-not-inside: |
          $OPTS = <... {cookie:{httpOnly:true}} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE = <... {httpOnly:true} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie = <... {httpOnly:true} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE.httpOnly = true;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie.httpOnly = true;
          ...
          $SESSION($OPTS,...);
  - id: express-cookie-session-no-domain
    message: >-
      Default session middleware settings: `domain` not set.
      It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested.
      If they match, then check the path attribute next.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      cwe:
      - 'CWE-522: Insufficiently Protected Credentials'
      owasp:
      - A02:2017 - Broken Authentication
      - A04:2021 - Insecure Design
      source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
      category: security
      technology:
      - express
      cwe2021-top25: true
      subcategory:
      - vuln
      likelihood: HIGH
      impact: LOW
      confidence: MEDIUM
      references:
      - https://owasp.org/Top10/A04_2021-Insecure_Design
    patterns:
      - pattern-either:
          - pattern-inside: |
              $SESSION = require('cookie-session');
              ...
          - pattern-inside: |
              $SESSION = require('express-session');
              ...
      - pattern: $SESSION(...)
      - pattern-not-inside: $SESSION(<... {cookie:{domain:...}} ...>,...)
      - pattern-not-inside: |
          $OPTS = <... {cookie:{domain:...}} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE = <... {domain:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie = <... {domain:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE.domain = ...;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie.domain = ...;
          ...
          $SESSION($OPTS,...);
  - id: express-cookie-session-no-path
    message: >-
      Default session middleware settings: `path` not set.
      It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      cwe:
      - 'CWE-522: Insufficiently Protected Credentials'
      owasp:
      - A02:2017 - Broken Authentication
      - A04:2021 - Insecure Design
      source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
      category: security
      technology:
      - express
      cwe2021-top25: true
      subcategory:
      - vuln
      likelihood: HIGH
      impact: LOW
      confidence: MEDIUM
      references:
      - https://owasp.org/Top10/A04_2021-Insecure_Design
    patterns:
      - pattern-either:
          - pattern-inside: |
              $SESSION = require('cookie-session');
              ...
          - pattern-inside: |
              $SESSION = require('express-session');
              ...
      - pattern: $SESSION(...)
      - pattern-not-inside: $SESSION(<... {cookie:{path:...}} ...>,...)
      - pattern-not-inside: |
          $OPTS = <... {cookie:{path:...}} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE = <... {path:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie = <... {path:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE.path = ...;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie.path = ...;
          ...
          $SESSION($OPTS,...);
  - id: express-cookie-session-no-expires
    message: >-
      Default session middleware settings: `expires` not set.
      Use it to set expiration date for persistent cookies.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      cwe:
      - 'CWE-522: Insufficiently Protected Credentials'
      owasp:
      - A02:2017 - Broken Authentication
      - A04:2021 - Insecure Design
      source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
      category: security
      technology:
      - express
      cwe2021-top25: true
      subcategory:
      - vuln
      likelihood: HIGH
      impact: LOW
      confidence: MEDIUM
      references:
      - https://owasp.org/Top10/A04_2021-Insecure_Design
    patterns:
      - pattern-either:
          - pattern-inside: |
              $SESSION = require('cookie-session');
              ...
          - pattern-inside: |
              $SESSION = require('express-session');
              ...
      - pattern: $SESSION(...)
      - pattern-not-inside: $SESSION(<... {cookie:{expires:...}} ...>,...)
      - pattern-not-inside: |
          $OPTS = <... {cookie:{expires:...}} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE = <... {expires:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $OPTS.cookie = <... {expires:...} ...>;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |
          $OPTS = ...;
          ...
          $COOKIE.expires = ...;
          ...
          $SESSION($OPTS,...);
      - pattern-not-inside: |-
          $OPTS = ...;
          ...
          $OPTS.cookie.expires = ...;
          ...
          $SESSION($OPTS,...);