Security: Session cookie defaults to secure=false and no sameSite attribute

[lucianjohnhouse]

Summary

express-session defaults cookie.secure to undefined (falsy) and does not set sameSite, meaning session cookies are sent over plaintext HTTP and are vulnerable to CSRF in older browsers.

Affected Code

session/cookie.js:25-44:

var Cookie = module.exports = function Cookie(options) {
  this.path = '/';
  this.maxAge = null;
  this.httpOnly = true;
  // NOTE: no this.secure = true; no this.sameSite = 'lax';
};

Default cookie attributes:

• httpOnly: true ✅
• secure: undefined (falsy) ❌ — cookie sent over HTTP
• sameSite: undefined (not set) ❌ — browser defaults vary

Impact

1. Session cookies transmitted over plaintext HTTP enable network sniffing (WiFi, MITM proxies)
2. Missing sameSite leaves CSRF protection to browser defaults — older browsers default to SameSite=None
3. Every deployment that does not explicitly set these options is affected

Additional Issue: MemoryStore unbounded DoS

MemoryStore (session/memory.js:40-43) has no session count limit, no max-size check, no eviction policy. With saveUninitialized default behavior, an attacker sending cookieless requests creates unlimited sessions until OOM.

I understand the README warns MemoryStore is for development only, but the cookie security defaults affect ALL store backends including production Redis/Mongo stores.

Suggested Fix

Default to secure cookie settings when possible:

this.sameSite = 'lax';
// And warn when secure is not explicitly set in production