I'm currently in the middle of a vulnerability assessment and have found the cookies do not have Secure or HttpOnly set. I have recommended they set both of these to true for their cookies, but the developers have replied with they are not going to, for the following reasons:
- They won’t be able to delete the cookie when logging out via javascript
- The cookie is only used for meta data, not to authenticate data requests
Is this a valid defense? I can't find any (security related) reasons for choosing to delete a cookie over setting Secure and HttpOnly.