CX Security_Misconfiguration @ server.js [master]

Custodela / NodeGoat

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project

Apache License 2.0

0 stars 0 forks source link

CX Security_Misconfiguration @ server.js [master] #10

Open kmcdon83 opened 6 years ago

kmcdon83 commented 6 years ago

Security_Misconfiguration issue exists @ server.js in branch master

The application takes sensitive, personal data cookieSecret, found at line 80 of server.js, and stores it in an unprotected manner, without encryption, to session at line 31 of server.js.

Severity: High CWE:933 Vulnerability details and guidance Internal Guidance Lines: 84

Code (Line #84):

        secret: config.cookieSecret,

kmcdon83 commented 6 years ago

Issue still exists.

kmcdon83 commented 6 years ago

Issue still exists.