id: JS-SEC-025
name: session-secret-weak
severity: high
language: javascript
cwe: CWE-798
owasp: "A07:2021"
description: "Detect hardcoded or weak session secrets in Express.js."
pattern:
  type: regex
  regex:
    - 'session\s*\(\s*\{.*secret\s*:\s*[\"''][^\"'']{1,15}[\"'']'
    - 'session\s*\(\s*\{.*secret\s*:\s*[\"''](secret|password|changeme|keyboard)'
    - 'cookieParser\s*\(\s*[\"''][^\"'']+[\"'']\s*\)'
message: "Weak or hardcoded session secret detected. Predictable session secrets allow session forgery."
fix_hint: "Load session secrets from environment variables. Use crypto.randomBytes(64).toString('hex') to generate strong secrets."
references:
  - https://cwe.mitre.org/data/definitions/798.html
  - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
