Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Remediation
Always setting httpOnly option when creating a cookie

Violation Code Sample

Cookie cookie = new Cookie("userName",userName); 
response.addCookie(cookie);

Fixed Code Sample

Cookie cookie = new Cookie("userName",userName); 
cookie.setSecure(true); 
cookie.setHttpOnly(true); // HttpOnly flag 

_________________________________________ 
Solution (Servlet 3.0 configuration): 
<web-app xmlns="http://java.sun.com/xml/ns/javaee" version="3.0" > 
[...] 
<session-config > 
 <cookie-config > 
  <http-only>true</http-only> 
  <secure>true</secure> 
 </cookie-config> 
</session-config> 
</web-app>

https://cwe.mitre.org/data/definitions/1004.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure