1

I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag.

The question here is should I fully ignore those flagged issues as these are false positives? or should I set the issue "Informational"? Thanks in advance!

Improve this question
2
  • Why not set the recommend cookie flags? Is the target app setting them?
    – Rodrigo Murillo
    Apr 8, 2022 at 15:54
  • 1
    Currently, doing regex test to ignore WAF cookie headers in Qualys WAS. The appscan always tagged the cookie header as an issue.
    – offsecgirl
    Apr 21, 2022 at 3:35

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .