How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?

Q: How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?

// Secure cookie configuration cookie: { httpOnly: true, // prevents document.cookie access — blocks XSS token theft secure: true, // only sent over HTTPS — blocks network interception sameSite: 'strict', // cookie not sent on cross-site requests — blocks CSRF maxAge: 3_600_000, } // Session fixation — regenerate session ID on login @Post('login') @UseGuards(AuthGuard('local')) async login(@Request() req) { // Regenerate prevents an attacker from fixing the session ID before login await new Promise ((resolve, reject) => req.session.regenerate(err => err ? reject(err) : resolve()), ); req.session.userId = req.user.id; return { message: 'Logged in' }; } // Privilege escalation — regenerate after elevating permissions async elevatePrivileges(req: Request): Promise { const userId = req.session.userId; await new Promise ((res, rej) => req.session.regenerate(e => e ? rej(e) : res()), ); req.session.userId = userId; req.session.elevated = true; } httpOnly — JavaScript cannot access the cookie via document.cookie; blocks XSS-based session theft. secure — cookie is only sent over HTTPS; prevents transmission over plain HTTP connections. sameSite: 'strict' — cookie is not sent on cross-site requests; the primary CSRF defense for modern browsers. Session fixation — attacker sets a known session ID before login; regenerate() issues a fresh ID at login. For cross-origin APIs (different domain frontend), use sameSite: 'none' + secure + add CSRF token header validation.

Difficulty: 6/10

CSRF protection, Cookie security flags, Session fixation mitigation

Set httpOnly to prevent JavaScript access (XSS), secure to HTTPS-only, and sameSite: 'strict' for CSRF protection. Regenerate the session ID on login to prevent session fixation. Also regenerate after privilege escalation to prevent session hijacking via pre-authentication sessions.

Secure cookie flags and session regeneration

Cookie security flags explained:

1
httpOnly — JavaScript cannot access the cookie via document.cookie; blocks XSS-based session theft.
2

How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?

Difficulty: 6/10

CSRF protection, Cookie security flags, Session fixation mitigation

Set httpOnly to prevent JavaScript access (XSS), secure to HTTPS-only, and sameSite: 'strict' for CSRF protection. Regenerate the session ID on login to prevent session fixation. Also regenerate after privilege escalation to prevent session hijacking via pre-authentication sessions.

Secure cookie flags and session regeneration

Cookie security flags explained:

1
httpOnly — JavaScript cannot access the cookie via document.cookie; blocks XSS-based session theft.
2

How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?

Set httpOnly to prevent JavaScript access (XSS), secure to HTTPS-only, and sameSite: 'strict' for CSRF protection. Regenerate the session ID on login to prevent session fixation. Also regenerate after privilege escalation to prevent session hijacking via pre-authentication sessions.

How do you secure session cookies against common attacks (CSRF, XSS, session fixation) in NestJS?

Set httpOnly to prevent JavaScript access (XSS), secure to HTTPS-only, and sameSite: 'strict' for CSRF protection. Regenerate the session ID on login to prevent session fixation. Also regenerate after privilege escalation to prevent session hijacking via pre-authentication sessions.

Scenario Questions

Follow-up Questions