Merge pull request #8592 from AmericanAirlines/fix-clear-text-cookie-codeql

fix: enforce cookie ssl in production

.changeset/twenty-hornets-train.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Enforce cookie SSL protection when in production for auth-backend sessions

plugins/auth-backend/src/service/router.ts

@@ -68,7 +68,15 @@ export async function createRouter(
   if (secret) {
     router.use(cookieParser(secret));
     // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    const enforceCookieSSL = authUrl.startsWith('https');
+    router.use(
+      session({
+        secret,
+        saveUninitialized: false,
+        resave: false,
+        cookie: { secure: enforceCookieSSL },
+      }),
+    );
     router.use(passport.initialize());
     router.use(passport.session());
   } else {