Oracle HttpOnly 和安全标志的 Apex 视图设置

Question

Based on the link below, current version of Oracle Apex cookies supports or automatically set as HTTP-only

https://community.oracle.com/tech/developers/discussion/4060471/httponly-and-secure-flags-in-session-cookie-and-all-cookies-for-oracle-apex-application

Now, we have security scanning which requires to provide evidence if the application is in HTTP-Only. Is there a way I can view this? Or is there any legit documentation from Oracle that can be reference to support the statement on the link? My Oracle Apex 21.1.6

Answer 1

Moreover, since JEE 6 it's also declaratively easy setting HttpOnly flag in a session cookie by applying the following configuration in the deployment descriptor WEB-INF/web.xml:

<session-config>
   <cookie-config>
    <http-only>true</http-only>
   </cookie-config>
</session-config>

Answer 2

This has been resolved after using Burp Suite - Application Security Testing Software . Rerun the process to Repeater, then yup, it shows there: