Security Missconfiguration express cookie

[gkouziik]

Rule 11

The user has to add httpOnly:true and secure:true properties in express cookie configuration!

HttpOnly HTTP header preventing cookies beeing accessed by scripts.The application used HTTPS secure connections,and cookies are configured to sent only on Secure HTTPS connections be Secure flag!
app.use(express.session({ secret: "s3Cur3", cookie: { httpOnly: true, secure: true } }));