When running a PCI DSS security scan (e.g., via VikingCloud or other Approved Scanning Vendors), you may receive a failed result or a warning regarding the nitroCachedPage cookie. The scanner typically flags this cookie because it is missing the Secure and HttpOnly attributes.
Why is this happening?
The nitroCachedPage cookie is created by NitroPack via inline JavaScript. Its sole purpose is to serve as a simple indicator of whether the served page is optimized by NitroPack. It only handles binary values (specifically, 0 or 1).
Because the cookie is dynamically generated via JavaScript on the client side, it cannot be marked with the HttpOnly flag (which restricts cookies to server-side access).
Is this a security risk?
No. The nitroCachedPage cookie does not store any session data, user identifiers, or sensitive personal information. Because it lacks session data and only contains a 0 or 1 state, it has zero exploit value.
How to Resolve the Issue:
Mark as a False Positive: In your PCI compliance dashboard (e.g., VikingCloud), locate the specific vulnerability report for the nitroCachedPage cookie. You can safely mark this finding as a "False Positive" or "Safe". You can use the explanation above to justify the exception to your scanning vendor.
We have contacted the National Vulnerability Database (NVD) to have the nitroCachedPage cookie officially whitelisted and flagged as safe. Once the NVD updates its records, future ASV scans should automatically ignore this cookie.