-
Notifications
You must be signed in to change notification settings - Fork 53
TWA 0801
Nemo edited this page Aug 18, 2020
·
1 revision
cookie '${cookie_name}' has 'secure' but no 'httponly' flag
A cookie was found in your HTTP response that is marked as secure (so it will only be sent over HTTPS), but without the httponly flag. The httponly flag ensures that the cookie is not readable by javascript, reducing the risk for session-hijacking attacks or XSS attacks.
In your application, set the httponly flag on the cookie. Most frameworks will have a configuration setting for this, and you can check the owasp or MDN docs for more information