Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Remediation
Do not provide a domain with wildcard access

Violation Code Sample

// .example.com is not recommended 

var express = require('express'); 
var session = require('express-session'); 

var app = express(); 

app.use(session({ 
  secret: 'My super session secret', 
  cookie: { 
    domain: '.example.com' 
  } 
}));

Fixed Code Sample

// explicit secure.example.com domain is recommended 
// .example.com is not recommended 

var express = require('express'); 
var session = require('express-session'); 

var app = express(); 

app.use(session({ 
  secret: 'My super session secret', 
  cookie: { 
    domain: 'secure.example.com' 
  } 
}));

https://cwe.mitre.org/data/definitions/287.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure