=== on 5 Mar 2018, 16:44:11 Alexandre Gigleux wrote:
Out of scope: this rule doesn't cover the case of ``++HttpOnly++`` configured properly in a web.xml:


----
<session-config>
 <cookie-config>
  <http-only>true</http-only>
 </cookie-config>
</session-config>
----

=== on 16 May 2018, 14:18:25 Andrei Epure wrote:
Also out of scope:

* https://docs.spring.io/spring-boot/docs/current/reference/html/common-application-properties.html[spring configuration] ``++server.servlet.session.cookie.http-only++``
* detecting common class that adds HttpOnly to all cookies passed around the app like Web Filter + https://github.com/ESAPI/esapi-java-legacy/blob/14e60d33207fd6a8e74151932a25b50e0de8e61b/src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java#L78[SecurityWrapperResponse.addCookie] method of the OWASP ESAPI project (see details in this https://stackoverflow.com/questions/35421596/cookie-http-only-with-spring-security-and-servlet-2-5#35493412[SO answer])


include::../comments-and-links.adoc[]
