Session tokens in secure HTTP-only cookies, SameSite=Strict

Session tokens stored in localStorage or accessible JavaScript variables are exfiltrable by any XSS payload on any page of the application. A single reflected or stored XSS vulnerability anywhere on the domain becomes a full session hijack with no additional effort. CWE-614 (Sensitive Cookie Without 'Secure' Attribute) and CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag) define these as distinct failures. OWASP A07 and PCI-DSS Req 6.4.1 mandate that session tokens be inaccessible to client-side scripts. In a financial application, exfiltrating a session token from localStorage via document.cookie or XSS requires zero CSRF bypass — the token is already JavaScript-readable and portable.

Configure session cookies with all three required attributes in src/lib/session.ts or the session middleware initialization:

session({
  cookie: {
    httpOnly: true,     // inaccessible to document.cookie and XSS
    secure: true,       // HTTPS transport only
    sameSite: 'Strict', // no cross-origin send (CSRF protection)
    maxAge: 15 * 60 * 1000
  }
})

Audit all calls to localStorage.setItem and sessionStorage.setItem in the codebase — no session token, auth token, or user identity value should appear as a storage key. Tokens are set exclusively by the server via Set-Cookie response headers; the client-side JavaScript never handles them.