I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag.

The question here is should I fully ignore those flagged issues as these are false positives? or should I set the issue "Informational"? Thanks in advance!

  • Why not set the recommend cookie flags? Is the target app setting them? Commented Apr 8, 2022 at 15:54
  • 1
    Currently, doing regex test to ignore WAF cookie headers in Qualys WAS. The appscan always tagged the cookie header as an issue.
    – offsecgirl
    Commented Apr 21, 2022 at 3:35


You must log in to answer this question.

Browse other questions tagged .