How to secure the s_cc & s_sq cookies

[matt_kupstas]

Is there a way to encrypt these two cookies using the standard secure flag?  What about httponly?

[devinderbanga]

Hi

Please consider below mentioned step while working with cookies:

• Limit the amount of sensitive information stored in the cookie.
• Limit the subdomains and paths to prevent interception by another application.
• Enforce SSL so the cookie isn’t sent in cleartext.
• Make the cookie HttpOnly so its not accessible to javascript.

Regards

Devinder

[matt_kupstas]

Hi Devinder,

If we set the secure flag and the httponly flag for the Site Catalyst cookies will it affect any functionality or stats?

[Ben_Bytheway · Accepted solution]

Hi Matt,

Just a follow up on this.  The s_cc and s_sq cookies are set and read within AppMeasurement code.  I don't believe there is anything that checks s_cc or s_sq on the server's end.  What this means is I don't think that you would be able to change how these cookies are set (httpOnly or secure) unless you are using your own s.trackingServer implementation and have a service to call on that domain that modifies these cookies.

Because they are read within the AppMeasurement javascript code, setting these to httpOnly would affect functionality and stats.

However, changing them to secure would probably not affect functionality or stats.

Thanks,

Ben

[devinderbanga]

Hi

As soon as it went under secure gateway the cookies need to be rewrite with the same value or could use specific programming functions to sustain the preset values.

Regards

Devinder