Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Remediation
Always setting httpOnly option when creating a cookie

Violation Code Sample

var express = require('express'); 
var session = require('express-session'); 

var app = express(); 

app.use(session({ 
  secret: 'My super session secret', 
}));

Fixed Code Sample

var express = require('express'); 
var session = require('express-session'); 

var app = express(); 

app.use(session({ 
  secret: 'My super session secret', 
  cookie: { 
    httpOnly: true, 
    secure: true 
  } 
}));

https://cwe.mitre.org/data/definitions/922.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10_2017-A6-Sensitive_Data_Exposure