SH101: Insecure session cookie settings

Severity: medium · Category: authentication · Applies to: express

Why it matters

Session cookies without Secure, HttpOnly and SameSite can be stolen by scripts, sent over plain HTTP, or abused in cross-site requests.

How to fix

Set cookie: { secure: true, httpOnly: true, sameSite: 'lax' }.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH101

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH101