Merge pull request #8592 from AmericanAirlines/fix-clear-text-cookie-codeql

fix: enforce cookie ssl in production
2021-12-27 19:13:59 +01:00
parent 2bb4402e6f 4ad024fd45
commit 62b3cea48d
2 changed files with 14 additions and 1 deletions
@@ -68,7 +68,15 @@ export async function createRouter(
  if (secret) {
    router.use(cookieParser(secret));
    // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    const enforceCookieSSL = authUrl.startsWith('https');
+    router.use(
+      session({
+        secret,
+        saveUninitialized: false,
+        resave: false,
+        cookie: { secure: enforceCookieSSL },
+      }),
+    );
    router.use(passport.initialize());
    router.use(passport.session());
  } else {