Express express-session weak secret key

Description

The application uses the express-session middleware for session management, which signs session cookies with a secret key to prevent tampering. A weak, default, or commonly-used secret key has been detected, allowing attackers to predict or guess the signing key. This vulnerability enables unauthorized modification of session data, potentially leading to session hijacking or privilege escalation.

Remediation

Replace the weak secret key with a cryptographically strong, randomly generated value. The secret should be at least 32 characters long and contain a mix of alphanumeric and special characters. Generate the secret using a secure random generator and store it in environment variables or a secure configuration management system, never in source code.

Example of secure implementation:

const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET, // Load from environment variable
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true }
}));

const crypto = require('crypto');
const secret = crypto.randomBytes(32).toString('hex');
console.log(secret);

References

Related Vulnerabilities