Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Remediation
Do not provide a root path

Violation Code Sample

// root path is not recommended 
var express = require('express'); 
var session = require('express-session'); 

var app = express(); 

app.use(session({ 
  secret: 'My super session secret', 
  cookie: { 
    path: '/' 
  } 
}));

Fixed Code Sample

// specifc path is recommended 

var express = require('express'); 
var session = require('express-session'); 

var app = express(); 

app.use(session({ 
  secret: 'My super session secret', 
  cookie: { 
    path: '/admin' 
  } 
}));

https://cwe.mitre.org/data/definitions/287.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure