OWASP Scan Issue: Cookie Slack Detector

[jacklimwenjie]

OWASP scan reported the cookie slack detector issue on a few next-auth REST API endpoints which includes:

• POST /api/auth/_log
• POST /api/auth/callback/credentials
• POST /api/auth/signout

Trying to understand the cookie slack detector issue on these endpoints. Deducing from the OWASP's description, does it means that repeated call on these endpoints by dropping one cookie at a time results in the same response?

If that's the case, I think most likely it's a false positive for POST /api/auth/_log and POST /api/auth/callback/credentials because their responses are not supposed to change with cookies, but how about POST /api/auth/signout? I am under the impression that the session cookie is needed to sign out, so why is this issue still being reported on this endpoint?