A few days ago we did a vulnerability test on the Gateway and it was reported that the cookie does not contain the "HTTPOnly" attribute.
This can cause the following:
"Cookies without the "HTTPOnly" attribute are allowed to be accessed via JavaScript. Cross-site scripting attacks can steal cookies, which could result in user impersonation or compromise the application account."
Any recommendations on how to fix this vulnerability???
Also a second vulnerability related to the previous one:
Cookie Does Not Contain The "secure" Attribute port 4434/tcp
The impact:
Cookies with the "secure" attribute can only be sent over HTTPS. Cookies sent over HTTP expose an unsuspecting user to tracking attacks that could result in user impersonation or compromise the application account.
Any suggestions?
