What Do I Do If a Scanner, such as AppScan, Detects that the Cookie Is Missing Secure or HttpOnly?

Cookies are inserted by back-end web servers and can be implemented through framework configuration or set-cookie. Secure and HttpOnly in cookies help defend against attacks, such as XSS attacks to obtain cookies, and help defend against cookie hijacking.

If the AppScan scanner detects that the customer site does not insert security configuration fields, such as HttpOnly and Secure, into the cookie of the scan request, it records them as security threats.

If you set Client Protocol to HTTPS, you can enable Cookie Security Attributes on the basic information page for the website. If you enable this, the HttpOnly and Secure attributes of cookies will be set to true.

Figure 1 Cookie Security Attributes