You have four Barracuda Web Application Firewalls serving three locations: New York, San Francisco and London. Your master Security Policies database dictates that all devices should have the HttpOnly attribute set to Yes for cookies, preventing the cookie from being accessed by client-side scripts.
To Configure: Click on the group of Barracuda Web Application Firewalls from the Cloud Control pane and check the SECURITY POLICIES > Cookie Security page. An exception triangle for this setting may display, as shown in the following image, if the devices are not in sync for this setting. Hover the mouse over the setting to view the values for Http Only on each device in the pop-up table.
Resolving the Exception: To resolve the issue, click on the NYC and London Web Application Firewalls, successively, in the product tree, and change the settings to match those of the two San Francisco systems. Once you save those settings, the exception triangle no longer appears next to the setting when viewed in the Group context.