Security Issue: Tokens exposed in both cookies and JSON response
Author: pavanx16Created Mar 28, 2026Updated Mar 28, 2026
Currently, the login API is returning accessToken and refreshToken in both HTTP-only cookies and the JSON response body.
.cookie("accessToken", accessToken, options)
.cookie("refreshToken", refreshToken, options)
.json({ user: loggedInUser, accessToken, refreshToken })Suggested Fix:
return res .status(200)
.cookie("accessToken", accessToken, options)
.cookie("refreshToken", refreshToken, options)
.json({ user: loggedInUser, message: "User logged in successfully" });Source: hiteshchoudhary/chai-backend