Not configuring the HTTP Only attribute as true in cookie settings exposes the cookie to potential access by client-side JavaScript. This oversight can lead to the exposure of sensitive cookie values, especially on websites vulnerable to Cross-Site Scripting (XSS) attacks. Enabling HTTP Only is critical to prevent malicious scripts from accessing cookie values through JavaScript.
Remediation Guidelines
To protect cookies from unauthorized access by client-side JavaScript, always set the HTTP Only attribute to true. This is a crucial measure in safeguarding your cookies against XSS vulnerabilities.
