While running a Qualys Vulnerability Scan on a website which is being developed I got the following vulnerability:
Cookie Does Not Contain The "HTTPOnly" Attribute
Cookie Does Not Contain The "secure" Attribute
My application running in ExpressJS, NodeJS and nginx web server. I am using express-session and csurf token. I have already set both HTTPOnly and secure flag true. Configuration is the following:
app.use(bodyParser.json({limit: '50mb'}));
app.use(bodyParser.urlencoded({extended: false, limit: '50mb'}));
app.use(cookieParser());
app.use(express.static(path.join(__dirname, "/../public")));
app.enable("trust proxy");
app.use(expressSession({
store: new MongoStore({
url: `session_db`
}),
secret: `session_secret`,
resave: true,
saveUninitialized: true,
proxy: true,
rolling: true,
cookie: {
secure: true,
httpOnly: false,
maxAge: (72 * 60 * 60 * 1000)
},
unset: "destroy"
}));
app.use(passport.initialize());
app.use(passport.session());
app.use(flash());
app.use("/api", api);
app.use( csrf({
cookie: {
secure: true,
httpOnly: true
}
}));//csrf
And my nginx configuration is:
location / {
proxy_pass http://nodejs;
proxy_set_header Host $host ;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_cookie_path / "/; HTTPOnly; Secure";
}
HTTPOnly and secure both flags are ticked in browser cookies section. but when I scan it, It shows me above mentioned vulnerabilities.
can someone help me?
Await your help friends
