Description

Identifies instances where cookies are generated without proper security attributes in TypeScript applications. Insecure cookie generation can expose applications to session hijacking and other cookie-based attacks, particularly when cookies store sensitive session data.

Detection Strategy

• Identifies cookie generation or manipulation in TypeScript code through cookie-related method calls or assignments

• Checks if required security attributes (httpOnly, secure, sameSite) are missing when setting cookies

• Reports a vulnerability when cookies are created without proper security configurations that protect against client-side access and network interception

Vulnerable code example

const express = require('express');
const app = express();

app.get('/unsafe', (req, res) => {
  // Security issue: Cookie set with secure:false allows transmission over HTTP
  res.cookie('sessionId', 'abc123', { secure: false });
  res.send('Cookie set');
});

✅ Secure code example

const express = require('express');
const app = express();

app.get('/unsafe', (req, res) => {
  // Set cookie with security flags to protect against attacks
  res.cookie('sessionId', 'abc123', {
    secure: true,    // Ensures cookie only sent over HTTPS
    httpOnly: true,  // Prevents JavaScript access to cookie...