Description
HttpOnly cookies are not enabled on this application. Any cookie marked with this property will be accessible only from server-side code, and not to any client-side scripting code like JavaScript or VBScript.This shielding of cookies from the client helps to protect Web-based applications from Cross-Site Scripting attacks.
Remediation
To enable HttpOnly cookies, set the value of the httpOnlyCookies attribute of the <httpCookies> element to true.
Example: <httpCookies httpOnlyCookies="true">