Why is this an issue?
Even within ServiceNow, cookies can be manipulated by attackers to illicitly access a user’s account or steal confidential information. A prime example is Cross-site scripting attacks, often abbreviated as XSS attacks. These are a form of injection assault that introduces harmful code into websites that are otherwise considered secure. An attacker exploits a vulnerability in a targeted web application to transmit malicious code, typically client-side JavaScript, to an end user.
In a client instance, for instance, such attacks can lead to unauthorized access, providing the attacker with an opportunity to access sensitive data.
To mitigate issues, ServiceNow has a system property named glide.cookies.http_only. While it does not entirely eradicate all cross-site scripting threats, it does provide an extra layer of security. It accomplishes this by preventing access to the cookie via a client-side script, such as JavaScript.
How do I fix it?
Before setting the glide.cookies.http_only property to true, note that if you have any custom functionality that relies on JavaScript accessing the user's cookie, it can cause it to break that functionality.
In the Filter Navigator, type and enter sys_properties.list.
Search for
glide.cookies.http_only.Set Value tab to true.