What Do I Do If a Scanner, such as AppScan, Detects that the Cookie Is Missing Secure or HttpOnly?

The cookie security attribute function is designed to enhance the security of web service cookies. It automatically adds the HttpOnly and Secure attributes (both set to true) to cookies returned by the origin server. This helps prevent security risks such as cross-site scripting (XSS) attacks, cookie hijacking, and man-in-the-middle (MITM) attacks that tamper with cookies. It also ensures compliance with security regulations and prevents web security scanners like AppScan, AWVS, and NSFOCUS from flagging the lack of security configuration fields such as HttpOnly and Secure in cookies as security threats.

If you set Client Protocol to HTTPS, you can enable Cookie Security Attributes on the basic information page for the website. If you enable this, the HttpOnly and Secure attributes of cookies will be set to true.

Figure 1 Cookie Security Attributes

After completing the above configuration, access the protected domain name through a browser, open the developer tool, and check whether the HttpOnly and Secure attributes of the cookie are set to true.