Checks

Session cookie missing HttpOnly

A session-like cookie does not set HttpOnly.

Why it matters

Page scripts can read it through document.cookie, so an XSS bug can steal the session.

What to do

Add HttpOnly unless JavaScript must read that cookie.

Reference

Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.

OWASP Session Management Cheat Sheet