> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/3-javascript/usage-of-default-session-cookie-configuration.md).

# Usage of Default Session Cookie Configuration

## Overview

* **Rule ID**: `javascript_express_default_session_config`
* **Applicable Languages**: Javascript
* **Weakness ID**: CWE-693

## Description

Using default session cookie configurations can expose your application to security vulnerabilities. When session cookies are set with default values, they become predictable and easier for attackers to exploit.

## Remediation Guidelines

* **Do not** rely on the default session cookie names and values provided by your framework. These defaults can be easily guessed by attackers, increasing the risk of session hijacking.
* **Use** generic, non-descriptive names for session cookies. This makes it harder for attackers to identify and exploit your application's session management mechanism.

## References

* [**Express Security Best Practices**](https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely)
* [**CWE-693: Protection Mechanism Failure**](https://cwe.mitre.org/data/definitions/693.html)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)