<!--
	Insecure cookies are set for these domains and hosts: ᶜ

		- www.mypoints.com
		- .www.mypoints.com

	ᶜ See https://owasp.org/index.php/SecureFlag

-->
<ruleset name="MyPoints.com">

	<target host="mypoints.com" />
	<target host="www.mypoints.com" />


	<!--	Not secured by server:
					-->
	<!--securecookie host="^www\.mypoints\.com$" name="^(?:BID|GOSECURE|HJS|JSESSIONID|MIDA)$" /-->
	<!--securecookie host="^\.www\.mypoints\.com$" name="^NMID$" /-->

	<securecookie host="^\." name="^_ga(?:t?$|t_)" />
	<securecookie host="^\.www\." name=".+" />
	<securecookie host="^\w" name=".+" />


	<rule from="^http:"
		to="https:" />

</ruleset>
