Set big_pipe_nojs cookie with HttpOnly=true

Drupal 9 is end-of-life and has no security support. Update to a supported version.

@cilefen, the same issue in Drupal 10.1:

core/modules/big_pipe/src/Controller/BigPipeController.php
$response->headers->setCookie(new Cookie(BigPipeStrategy::NOJS_COOKIE, TRUE, 0, '/', NULL, FALSE, FALSE, FALSE, NULL));

It sets HttpOnly to FALSE.

I've encountered this issue and realized that we need to secure the cookies by ensuring our website is configured to use HTTPS, which involves having an SSL/TLS certificate installed. Additionally, the cookies should have the Secure attribute.

There are multiple ways to add these security flags, either by editing the application code (bigpipe code) or updating the web server configuration files, such as the Apache configuration file (httpd.conf or apache2.conf).

Apache configuration file (httpd.conf or apache2.conf).

<IfModule mod_headers.c>
    Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
</IfModule>

bigpipe explicitly sets the secure and httponly attributes to false.

What's the justification for that to be changed?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#block_access_t...

The big_pipe_nojs cookie is just a boolean flag, the purpose of which is explained in \Drupal\big_pipe\Render\Placeholder\BigPipeStrategy

The HTTPonly and Secure attributes are intended to protect potentially sensitive information contained in cookies, and to prevent JS/client side code from being able to manipulate sensitive cookies.

None of that applies to this cookie, so it's legitimate for it not to have those attributes set.

Is the only reason to change them to prevent false positives from security scans?