Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service. Cross-site scripting attacks often access cookies in an attempt to steal session identifiers or authentication tokens. This is why all major browsers support the HttpOnly cookie property that prevents client-side scripts from accessing the cookie. When HttpOnly is not enabled, attackers may more easily access user cookies.

Remediation
Always setting httpOnly option when creating a cookie

Violation Code Sample

document.cookie = "tagname=test;";

Fixed Code Sample

document.cookie = "tagname=test;HttpOnly";

https://cwe.mitre.org/data/definitions/1004.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure