> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/3-javascript/usage-of-default-cookie-configuration.md).

# Usage of default Cookie Configuration

## Overview

* **Rule ID**: `javascript_express_default_cookie_config`
* **Applicable Languages**: Javascript
* **Weakness ID**: CWE-693

## Description

Using default cookie configurations can expose your application to security risks. This vulnerability occurs when cookies are set with default values, making them predictable and easier for attackers to exploit.

## Remediation Guidelines

* **Do not** rely on default cookie names.
* **Do use** generic, non-descriptive names for session cookies. This makes it harder for attackers to identify and exploit your application's session management mechanism.
* **Do always** specify a `maxAge` or `expires` value to control the cookie's lifetime.

## References

* [**Express Security Best Practices**](https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely)
* [**CWE-693: Protection Mechanism Failure**](https://cwe.mitre.org/data/definitions/693.html)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)