Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

cookie flags are raised in burpscan but not in manual testing.

Ryan | Last updated: May 29, 2023 04:30AM UTC

burp scanner keeps raising the issue(s): - TLS cookie without secure flag set - Cookie without HttpOnly flag set. However, when replicating the same request manually (either by closing the session and re-opening, or private browsing), it was noted that the set-cookie headers all have the secure and httponly flags set on the cookies. only the ones in the burp issues do not have the flags. why is that so? appreciate any input.

Michelle, PortSwigger Agent | Last updated: May 30, 2023 11:01AM UTC

Hi Can you please email support@portswigger.net with a few more details? For example, when you replicate the issue manually, are you using the same requests as reported by the Scanner or are you using different steps to try and replicate it? If so, can you please describe the steps you are taking? Would you be happy to share screenshots of the requests and responses reported by Burp Scanner and the requests and responses you see when you try to replicate the issue?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.