# Cookie "HTTPOnly" and "secure" attribute vulnerability **URL:** \ **Category:** Get Help\ **Tags:** api, vulnerability, auth0, login\ **Created:** [February 8, 2022, 9:43am UTC](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/77868 "2022-02-08T09:43:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![andreinechifor83](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andreinechifor83/32/34621_2.png) [@andreinechifor83](https://community.auth0.com/u/andreinechifor83)\ **Post date:** [February 8, 2022, 9:43am UTC](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/77868/1 "2022-02-08T09:43:41Z")
Hello, When I scan my Frontend Page with “Qualys API SCAN” software that is intended to find vulnerabilities, it lands on AUTH0 authentification page. And it finds 2 problems with the cookies: **Cookie Does Not Contain The “secure” Attribute** **Cookie Does Not Contain The “HTTPOnly” Attribute”** Example of such a cookie: com.auth0.auth.ugKuorXXXXX… Is this normal or it is a security problem for the cookies don’t have those attributes? Thank you! ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [February 22, 2022, 11:24pm UTC](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/77868/3 "2022-02-22T23:24:29Z")
Hi @andreinechifor83, Welcome to the Auth0 Community! Not all cookies will be marked HTTPOnly and secure. Can you tell me the name of the cookie you are referring to? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [April 8, 2022, 4:41pm UTC](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/77868/4 "2022-04-08T16:41:39Z")