I have scanned the system for security vulnerabilities and found the following vulnerabilities that need to be addressed.

1. Cookies Not Marked as Secure.
2. Cookies with missing, inconsistent or contradictory properties.

I confirmed my system configuration as follows.

• \PegaXXX\Tomcat9\conf\web.xml 

    -<session-config>
        <session-timeout>30</session-timeout>
        -<cookie-config>
            <http-only>true</http-only>
            <secure>true</secure>
        </cookie-config>
    </session-config>

• System Settings

​​

• \PegaXXX\Tomcat9\conf\context.xml

    <CookieProcessor sameSiteCookies="strict"/>

 

How do I fix these two security vulnerabilities?