Static asset with active session detected.

• Rule ID: javascript_express_static_asset_with_session
• Languages: javascript
• Source: static_asset_with_session.yml

Description

Static assets are often cached by services in front of the application (eg. CDNs). Serving static assets with sessions enabled may lead to Cross-Site Request Forgery (CSRF) attacks that can hijack a user's session.

Remediations

✅ Ensure static resources are handled prior to session initialization:

  // static middleware should be added before session middleware
  app.use(express.static(__dirname + "/public"))

  app.use(session())

Associated CWE

• CWE-352: Cross-Site Request Forgery (CSRF)
• CWE-668: Exposure of Resource to Wrong Sphere

OWASP Top 10

• A01:2021 - Broken Access Control