René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Medium][server] Session and CSRF cookies are not Secure by default","articleBody":"## Severity: 🟡 Medium (insecure default; direct credential-theft impact)\n\n## Location\n- Session cookie: [`src/server/session.ts:301-306`](../blob/main/src/server/session.ts#L301-L306) (and destroy path `:336-343`)\n- CSRF secret cookie: [`src/server/csrf.ts:159-163`](../blob/main/src/server/csrf.ts#L159-L163)\n\n## Description\nThe session-id cookie defaults to `{ httpOnly: true, sameSite: 'lax', path: '/' }` with **no `secure`**:\n```ts\nconst baseCookie: ServerCookieOptions = {\n  httpOnly: true,\n  sameSite: 'lax',\n  path: '/',\n  ...options.cookie,\n};\n```\nThe cookie holds the signed session id — the sole bearer credential for the session. On any deployment reachable over plain HTTP (mixed HTTP during redirect, or behind a misconfigured proxy), the cookie is transmitted in cleartext and can be captured by a network MITM, yielding full session hijack. `sameSite: 'lax'` does not compensate. The behaviour is documented (\"Set `secure: true` in production\"), but insecure-by-default for a session credential is a real trap for anyone who doesn't read the note.\n\nThe CSRF secret cookie (`csrf.ts`) has the same default (`{ sameSite: 'lax', path: '/' }`, no `secure`); in signed mode the token embeds the raw secret, so a MITM over HTTP can read it and forge matching tokens.\n\n## Suggested fix\nDefault `secure: true` and let users explicitly opt out for local HTTP dev, e.g. `secure: options.cookie?.secure ?? true`; or auto-enable `Secure` when the request/base URL is `https:`. Apply consistently to both the session and CSRF cookies. Consider promoting `__Host-` guidance from a doc note to a runtime default.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:13.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/169/bQuery/issues/169"}