Expand my Community achievements bar.

Dive into Adobe Summit 2024! Explore curated list of AEM sessions & labs, register, connect with experts, ask questions, engage, and share insights. Don't miss the excitement.

Adding secure and httponly attributes to JSESSIONID cookie

Avatar

Level 2

Hi All,

We have used session from request to store few data. When we access the session, it generates JSESSIONID cookie. But the generated JSESSIONID cookie does not have cookie attributes "secure" and "httponly".

Can anyone please provide me pointers on how to add these flags to the JSESSIONID cookie in AEM.

Thanks in advance,

Amuthesan

3 Replies

Avatar

Level 2

Hi Scott,

Thanks for the reply. 

We are currently offloading the SSL at the dispatcher level and the communication with AEM is non SSL. And also if we enable the SSL for the AEM, all the cookies would be made secure and httponly, we do not want that. We want only the JSESSIONID cookie to be made secure. As we understand the cookie is created and managed by container, Is there any configuration/input that can be made to the container to create the cookie with the secure and httponly.

Thanks,

Amuthesan