[PR #5274] [MERGED] chore(backend): prevent clear text transmission of sensitive cookie #5133

New issue

Closed

opened 2026-03-17 02:36:32 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:36:32 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5274
Author: @mirarifhasan
Created: 7/24/2025
Status: ✅ Merged
Merged: 7/28/2025
Merged by: @jamesgeorge007

Base: next ← Head: fix/code-scanning-52

📝 Commits (3)

b29845c fix: clear text transmission of sensitive cookie
6d1edf0 chore: feedback resolved
935c12c chore: resolve merge conflicts

📊 Changes

1 file changed (+11 additions, -1 deletions)

View changed files

📝 packages/hoppscotch-backend/src/main.ts (+11 -1)

📄 Description

Closes SHBE-551

What’s changed

This PR addresses the security issue reported in Code Scanning Alert #52, related to the clear text transmission of a sensitive cookie.

Applied appropriate cookie flags (Secure, HttpOnly, SameSite) to ensure secure handling.
Verified the cookie is no longer transmitted in non-secure environments.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5274 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 7/24/2025 **Status:** ✅ Merged **Merged:** 7/28/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `fix/code-scanning-52` --- ### 📝 Commits (3) - [`b29845c`](https://github.com/hoppscotch/hoppscotch/commit/b29845cf0ac69b71b26136e69a3ec06cebdf83ae) fix: clear text transmission of sensitive cookie - [`6d1edf0`](https://github.com/hoppscotch/hoppscotch/commit/6d1edf078fba3d83540553ce0522ef75d358895c) chore: feedback resolved - [`935c12c`](https://github.com/hoppscotch/hoppscotch/commit/935c12cf9218b6a5f5c66929eed270727ee3b67e) chore: resolve merge conflicts ### 📊 Changes **1 file changed** (+11 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/main.ts` (+11 -1) </details> ### 📄 Description  Closes SHBE-551 ### What’s changed This PR addresses the security issue reported in [Code Scanning Alert #52](https://github.com/hoppscotch/hoppscotch/security/code-scanning/52), related to the clear text transmission of a sensitive cookie. - Applied appropriate cookie flags (`Secure`, `HttpOnly`, `SameSite`) to ensure secure handling. - Verified the cookie is no longer transmitted in non-secure environments. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>