Secure and HttpOnly flag for load balancer cookie

Question

Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a session identifiers. Should I add this flags to all three cookies?

Answer 1

I'd assume you don't want to share at least BIGipServer and IDSESSION with malicious users, because first one probably leads to information disclosure and second - to session hijacking. If there is a probability of an XSS in your application then mentioned flags are definitely necessary.