[5.1.0] Security flags at the cookies are missing.

[tuxmaster5000]

Our security scanner has detected, that the secure and HttpOnly flag is missing at the _uid cookie. Can you fix it?

Sample: nmap -p 443 --script http-cookie-flags --script http-headers ... | Set-Cookie: _uid=307343fb-efd1-42ba-87c0-dfee9d8e1652 ...

Thanks

[ymarcon]

See Reverse proxy recommended settings (headers section).

[ymarcon]

That is true that the HttpOnly flag should be enforced for this cookie. In the meantime you should use the workaround above (which does a bit more than setting HttpOnly flag, then it is still the recommended approach).