Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a session identifiers. Should I add this flags to all three cookies?
0
I'd assume you don't want to share at least BIGipServer
and IDSESSION
with malicious users, because first one probably leads to information disclosure and second - to session hijacking. If there is a probability of an XSS in your application then mentioned flags are definitely necessary.
IDSESSION
is, but what about the two others? – Anders Nov 6 '18 at 14:42