I scan my application using PCI Scanner from Clone-system. It show 1 vulnerabilities -> Missing httpOnly Cookie Attribute.
httpOnly
This is the report https://