ASP.NET cookies accessible from client-side scripts (AcuSensor)

Description
  • HttpOnly cookies are not enabled on this application. Any cookie marked with this property will be accessible only from server-side code, and not to any client-side scripting code like JavaScript or VBScript.This shielding of cookies from the client helps to protect Web-based applications from Cross-Site Scripting attacks.
Remediation
  • To enable HttpOnly cookies, set the value of the httpOnlyCookies attribute of the element to true.

    Example: