Potential fix for code scanning alert no. 17: Clear text transmission of sensitive cookie

[mdawoud27]

Potential fix for https://github.com/TaskTrial/server/security/code-scanning/17

To fix the issue, the secure attribute of the session cookie should be set to true. This ensures that the cookie is only transmitted over HTTPS. Since this is a testing environment, you can dynamically set the secure attribute based on the environment (e.g., process.env.NODE_ENV). For example, in development mode, you might keep it false, but in production mode, it should always be true. This approach maintains flexibility while adhering to security best practices.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a security alert by making the session cookie’s secure attribute dynamic—enabled in production and disabled otherwise.

• Replace hardcoded secure: false with process.env.NODE_ENV === 'production'
• Ensure tests use the same logic in the mock app setup

Comments suppressed due to low confidence (3)

src/tests/mocks/app.mock.js:28

• There aren’t any tests verifying that cookie.secure toggles correctly based on NODE_ENV. Adding a unit test for both production and non-production scenarios would catch regressions.

    cookie: {

src/tests/mocks/app.mock.js:29

• Consider adding a sameSite attribute (e.g., sameSite: 'lax') to the cookie configuration to further mitigate CSRF risks.

      secure: process.env.NODE_ENV === 'production',

src/tests/mocks/app.mock.js:29

• [nitpick] Accessing process.env.NODE_ENV directly inside a test mock can lead to brittle tests—consider injecting the environment or mocking this value explicitly for clarity and consistency.

      secure: process.env.NODE_ENV === 'production',