Cookie HttpOnly being reported incorrectly

Rules and Languages Report False-positive / False-negative...
1

Version: Community EditionVersion 7.6 (build 21501)
Vulnerability: squid:S3330 “HttpOnly” should be set on cookies

This vulnerability is being reported (in a number of locations), but as you can see from the screenshot, its looks like it has already been addressed.

HttpOnly_Issue
HttpOnly_Issue.png980×217 37.8 KB

2

Should have added were using SonarJava Analyzer (v5.14 - build 18788)

3

Sorry, I don’t manage to reproduce the issue.
Can you share a more complete example?