Forum Discussion
AshuA_246482
Nimbostratus
NimbostratusHow to fix secure cookie parameter - finding of pen test
We had a pen test get done on newly deployed application. and one of their finding is
When cookies are set which are used on the encrypted (HTTPS) part of the website, the Secure cookie paramete...
AshuA_246482Nimbostratus
NimbostratusAnother finding : cookie & requestVerificationToken is set without the HttpOnly Cookie parameter
question : How to set cookie & requestVerificationToken with the HttpOnly Cookie parameter on LTM running on 11.6 Risk : When a cross-site scripting vulnerability is present, an attacker may unnecessarily be able to retrieve sensitive information from cookies. Recommendation: Supply the HttpOnly cookie parameter when the server sets a cookie through Set-Cookie.
