Express express-session Weak Secret Key Detected

Severity: Medium

Invicti detected that a weak secret is used in Express sessions.

The Express web application uses the express-session middleware. The middleware stores a session id in a cookie and uses a secret key to sign it for protection against data tampering. The application is using a weak/known secret key and Invicti managed to guess this key.


An attacker can tamper the session id in the cookie.

Actions To Take#

Change the value of the secret key to a long random string.

Invicti Logo

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo