Session-like cookie is missing the HttpOnly attribute
ShipReady found a session-like cookie in a Set-Cookie response header without the HttpOnly attribute.
Why it matters
HttpOnly asks browsers to withhold the cookie from JavaScript. It is a script-access control, distinct from Secure transport handling.
How ShipReady detects it
What it inspects
ShipReady reads Set-Cookie headers from responses it already fetched and applies session-like name rules that exclude CSRF, redirect, preference, consent, and related non-session cookies.
What triggers a finding
The rule triggers when a qualifying cookie header lacks the literal HttpOnly attribute.
What the evidence shows
The observed response set the named qualifying cookie without HttpOnly. The cookie value is not collected or reported.
Limits of this check
ShipReady does not execute page JavaScript, find an XSS flaw, inspect every response, or establish that the cookie represents an authenticated session. Missing HttpOnly alone does not prove script theft or exploitation.
How to fix it
Set HttpOnly where the client does not need the value
Configure the session cookie with HttpOnly if client-side JavaScript does not need to read it.
Review intentional script-readable cookies
If a client script needs a cookie value, verify that its role and exposure are intentional rather than applying HttpOnly blindly.
How to verify the change
Inspect the deployed Set-Cookie header
Exercise the route that creates the cookie and inspect its response headers without retaining the cookie value.
Expected: The intended session cookie includes HttpOnly when JavaScript access is unnecessary.