Kotlin : Cookie: not HttpOnly

The application creates cookies without setting the httpOnly flag to true. If the httpOnly flag is included in the HTTP response header, the cookie cannot be accessed through client side script. As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser will not reveal the cookie to a third party. If the httpOnly flag isn’t included in the HTTP response header, the cookie (typically your session cookie) becomes vulnerable to theft of modification by malicious script.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.