Secure - This an attribute tells the browser to only send the cookie the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP and HTTPS, then there is the potential that the cookie can be sent in cleartext. The "Path" attribute of cookie signifies the URL or path for which the cookie is valid. The default value is "/". The Path attribute controls the set of paths that limits the scope of cookies. User agents use the directory in the request-URI's path component by default whenever a web server elides the Path attribute. The cookies are incorporated by the user agents only when the request-URI's path segment is equal to the cookies' Path attribute. Expires - This attribute is used to set persistent cookies. It signifies how long the browser should use the persistent cookie and when the cookie should be deleted. In this application, it is observed the following session cookies are set by the application without Secure, Path, Expires cookie attributes.

It is observed in Business Central Following Session Cookie "JSESSIONID" is missing cookie attributes Secure, Path and Expires/Max-Age. JSESSIONID=k6VaOkHX0pV0kvHBlK9QeRGz6IzpQ03af1LvhZ53.ibm-rhpamcentr-4-jctrc; path=/; HttpOnly