How to add the HttpOnly flag to a cookie
A login cookie without HttpOnly can be read by JavaScript, so any XSS flaw lets an attacker steal it and take over the account.
How to fix it
Your web server
Where: wherever you set the cookie (app framework session config, or Set-Cookie header)
Add the HttpOnly attribute when you set the cookie. Examples:
Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax
Express: res.cookie('session', v, { secure: true, httpOnly: true, sameSite: 'lax' })
Django: SESSION_COOKIE_SECURE = True / _HTTPONLY = True / _SAMESITE = 'Lax'
PHP: session_set_cookie_params(['secure'=>true,'httponly'=>true,'samesite'=>'Lax'])Set HttpOnly on session/auth cookies so JavaScript (and thus XSS) can't read the cookie.
How to confirm: Re-scan — the cookie-flag finding should clear.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free