Why this matters
TLS and secure session cookies meet SOC 2 encryption-in-transit expectations.
Use helmet to set HSTS and configure cookies with Secure, HttpOnly, and SameSite. Reject HTTP by redirecting to HTTPS.
TLS and secure session cookies meet SOC 2 encryption-in-transit expectations.
Side-by-side examples engineers can pattern-match during review.
app.use((req,res,next)=>next()); // no headersapp.use(require('helmet')({ hsts: { maxAge: 31536000, includeSubDomains: true } }));
res.cookie('sid', v, { secure:true, httpOnly:true, sameSite:'lax' });app.use(helmet())res.cookie('sid', v)From the same buckets as this rule.
Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.