Following a Pen test on our application which is using the Auth0 SPA SDK (Angular), the following Cookies are flagging up as not being marked as secure and not being marked as HTTPOnly.
Appreciate that the latter is because the cookie needs to accessible in JS but just wanted to confirm this and that the same applies for the “Secure” setting ?
-The following cookies are not set with the HTTPOnly or secure attribute:
- auth0.organization_hint
- _legacy_auth0.organization_hint
- auth0.is.authenticated
- _legacy_auth0.is.authenticated
Basically I need to know if this is an issue that we can resolve or if its a risk we’ll need to sign off on due to the way our application uses Auth0.