CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.

From the CWE List. © The MITRE Corporation.