Adding secure attribute to cookie | Community
Skip to main content
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
raj_mandalapu
raj_mandalapuAccepted solution
Level 7
Feb 23, 2021 10:59 AM UTC

@shaheena_sheikh ,if you don't make your cookie secure, then the cookie can be transmitted over the HTTP connection. so if you use HTTPS also, it is good practice to make your cookie secure.

Check below code 

Cookie emailCookie = new Cookie("email", email);
emailCookie.setPath("/");
emailCookie.setMaxAge(31536000);
emailCookie.setPath(";Path=/;HttpOnly;");;
emailCookie.setSecure(true);
response.addCookie(emailCookie);

 

The cookies which you create using javascript also should make secure. 

4 replies

raj_mandalapu
raj_mandalapuAccepted solution
Level 7
Feb 23, 2021 10:59 AM UTC

@shaheena_sheikh ,if you don't make your cookie secure, then the cookie can be transmitted over the HTTP connection. so if you use HTTPS also, it is good practice to make your cookie secure.

Check below code 

Cookie emailCookie = new Cookie("email", email);
emailCookie.setPath("/");
emailCookie.setMaxAge(31536000);
emailCookie.setPath(";Path=/;HttpOnly;");;
emailCookie.setSecure(true);
response.addCookie(emailCookie);

 

The cookies which you create using javascript also should make secure. 

Translate
Anudeep_Garnepudi
New Participant
Feb 23, 2021 8:29 AM UTC

@shaheena_sheikh 

You can set HttpOnly and Secure flags to cookie. Check the below Cookie API documentation. Use setSecure(boolean flag) and setHttpOnly(boolean isHttpOnly).

https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html

 

Translate
Vaibhavi_J
Level 7
Feb 23, 2021 8:27 AM UTC

Hi @shaheena_sheikh , 

 

Is your pages are rendered over https protocal?? If so OOTB will add secure flags on all cookies. You can additionally achieve this through api as well . 

Check out the below thread for similar query 

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/aem-session-cookie-with-httponly-and-secure-flag/qaq-p/206712

Translate
Level 6
Feb 23, 2021 8:39 AM UTC
My page is loading on HTTPS but yet I can see a few cookies not being HttpOnly/Secure
Translate