Ctrlk
Back To Rafflex.io
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Cookie Vulnerability (Facebook Pixel) False Positive

Why PCI scans sometimes flag the Facebook Pixel cookie, and the response you can submit to mark it as a false positive.

Some PCI scans report a "Cookie Vulnerability" against a cookie named _fbp, noting that it is missing the Secure and HttpOnly flags. If you see this in your results, it is a false positive and can safely be marked as one. This page explains why, and gives you a response you can copy and paste into the scan portal.

What is the _fbp cookie?

_fbp is the Facebook (Meta) Pixel cookie. If you have connected a Facebook Pixel to your site for advertising, Facebook's own tracking script places this cookie in your visitor's browser. It is used to work out which advert a visitor came from, so your ad reporting and targeting work correctly.

It is an anonymous advertising identifier. It does not contain any login, session, payment, or card information.

Why is it flagged, and why is it safe?

The scanner expects every cookie to carry the Secure and HttpOnly flags. This cookie cannot, for two reasons that are outside our control.

  1. It is not set by our servers. The cookie is created by Facebook's script running in the visitor's browser, not by your RaffleX site. The Secure and HttpOnly flags can only be applied to cookies that a website's own server issues, so neither we nor you can set them on a Facebook cookie.

  2. HttpOnly is impossible here by design. The whole purpose of the HttpOnly flag is to hide a cookie from JavaScript. The Facebook Pixel needs JavaScript access to that cookie in order to function, so the flag cannot be applied. This is how the pixel is meant to work, not a fault.

Because the cookie holds no sensitive data, the underlying concern the scanner raises (someone stealing session or card information) simply does not apply. There is nothing of value in the cookie to take.

The only way to remove this finding entirely is to remove the Facebook Pixel from your marketing settings. That would also stop your Facebook ad tracking, so most sites choose to mark the finding as a false positive instead.

Response to Submit

When raising the false positive in the scan portal (follow steps 1 to 8 on the PCI Compliance Scan page), add this comment:

The cookie flagged in this finding (_fbp) is set by the Meta (Facebook) advertising pixel, which runs as third party JavaScript in the visitor's browser. It is not issued by our web servers, so the Secure and HttpOnly attributes cannot be applied to it. By design, a cookie created by client side JavaScript cannot be marked HttpOnly, because that attribute exists specifically to hide a cookie from JavaScript, which the pixel requires in order to function.

The cookie contains only an anonymous advertising identifier used for ad attribution. It holds no authentication, session, payment, or cardholder data, so the information disclosure risk described in the finding does not apply. As the cookie originates from a third party service outside our hosted environment and outside our control, and as it carries no sensitive data, this finding is a false positive and should be marked accordingly.

Last updated