'HttpOnly' Flag Missing from User Management Cookies

[AdrianaMoralesQ]

Hi all, 

We recently conducted a pen-test on our Shopify storefront via a third party security company. They identified some cookies, flagged as being used for session management, which do not have the HttpOnly attribute set.

The cookies flagged were: 

• _shopify_sa_p
• _shopify_sa_t
• _shopify_s
• _shopify_y
• _tracking_consent
• cart-currency
• keep_alive
• shopify_pay_redirect

Can someone confirm whether these cookies are actually used for session management and whether them lacking HttpOnly can lead to theft via cross-site scripting (XSS) attacks?