title: CheckMarx Medium severity warning - HttpOnly cookie at Startup
body: <p>CheckMarx is flagging an error which looks like a false positive to me. Our application is written in C# and uses ASP.NET Core.</p>
  <p>The error is:</p>
  <blockquote>
  <p>The web application's Startup method creates a cookie Startup, at line 22 of Startup.cs, and returns it in the response. However, the application is not configured to automatically set the cookie with the &quot;httpOnly&quot; attribute, and the code does not explicitly add this to the cookie.</p>
  </blockquote>
  <p>This is line 22:</p>
  <pre><code>public class Startup
  </code></pre>
  <p>And we do have the cookie policy set correctly:</p>
  <pre><code>app.UseCookiePolicy(new CookiePolicyOptions
  {
      HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.Always
  });
  </code></pre>
  <p>But CheckMarx is still flagging this warning. And I do not think that my Startup class creates a cookie called Startup.</p>
  <p>I found a similar post here (unanswered) - <a href="https://github.com/Azure/azure-functions-vs-build-sdk/issues/469" rel="nofollow noreferrer">https://github.com/Azure/azure-functions-vs-build-sdk/issues/469</a>.</p>
  <p>So is this a false positive? And how do I get CheckMarx to stop flagging it?</p>