Merge pull request #286 from cfabianski/patch-1

doc: annotate server.js with extra info regarding session and static …

Author: lirantal

server.js

@@ -116,6 +116,8 @@ MongoClient.connect(db, (err, db) => {
     app.engine(".html", consolidate.swig);
     app.set("view engine", "html");
     app.set("views", `${__dirname}/app/views`);
+    // Fix for A5 - Security MisConfig
+    // TODO: make sure assets are declared before app.use(session())
     app.use(express.static(`${__dirname}/app/assets`));