utag_main Cookie does not have HTTPOnly attribute.

[homerocavazos]

Hailstorm scan complains that 'utag_main' does not have HTTPOnly attribute. Is there a way to fix this vulnerability? 

[craig_rouse · Accepted solution]

Hi @homerocavazos. This warning can be safely ignored. The HTTPOnly flag is only used for cookies set on the server-side, and it is not possible to set this flag when creating a cookie using JavaScript.

Since Tealium iQ is a client-side technology, we are setting the utag_main cookie using JavaScript. Therefore, it is not possible to set the HTTPOnly flag.

[homerocavazos]

This confirms what I believed to be the case. 

Thanks.