The HTTPOnly attribute makes cookies inaccessible to JavaScript. Additionally, the Secure attribute
ensures that the cookie may only be transmitted over HTTPS. Cookies used by the application did
not have the HTTPOnly or Secure attribute set. This included but was not limited to the session
cookie PTISessionID.

Fix IIS

<configuration>
<system.web>
<httpCookies httpOnlyCookies=’true’ />
</system.web>
</configuration>