Language: TypeScript
Label: vulnerable
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
  constructor(options: SerializeFunction | { key?: string }, serializeUser?: SerializeFunction) {
    if (typeof options === 'function') {
      this.serializeUser = options
      this.key = 'passport'
    } else if (typeof serializeUser === 'function') {
      this.serializeUser = serializeUser
      this.key =
        (options && typeof options === 'object' && typeof options.key === 'string' && options.key) || 'passport'
    } else {
      throw new Error('SecureSessionManager#constructor must have a valid serializeUser-function passed as a parameter')
    }
  }