ASP.NET cookies accessible from client-side scripts

Description

HttpOnly cookies are not enabled on this application. Any cookie marked with this property will be accessible only from server-side code, and not to any client-side scripting code like JavaScript or VBScript.This shielding of cookies from the client helps to protect Web-based applications from Cross-Site Scripting attacks.

Remediation

To enable HttpOnly cookies, set the value of the <strong>httpOnlyCookies</strong> attribute of the &lt;httpCookies&gt; element to <strong>true</strong>.<br/><br/>Example: &lt;httpCookies httpOnlyCookies=&quot;true&quot;&gt;

References

Related Vulnerabilities