Hi,I have the below requirement could someone provide inputs as what could be doneI need to set the secure flag for login-token cookie. Currently "TokenUtil.createCredential()" method is having the argument to set the cookie as HttpOnly.I need the sessionPersistence cookie to be HttpOnly and secure.Please suggest a way to achieve this in CQ5 version 5.6.1Thanks,Satheeshraj V

S

satheeshraj

Solved

setting Secure and HttpOnly flag in Cookie

Forum|Forum|10 years ago
November 2, 2015
5 replies
8099 views

Hi,

I have the below requirement could someone provide inputs as what could be done

I need to set the secure flag for login-token cookie. Currently "TokenUtil.createCredential()" method is having the argument to set the cookie as HttpOnly.
I need the sessionPersistence cookie to be HttpOnly and secure.

Please suggest a way to achieve this in CQ5 version 5.6.1

Thanks,

Satheeshraj V

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

Best answer by Sham_HC

enable aem with ssl. https://docs.adobe.com/docs/en/cq/5-6-1/deploying/config-ssl.html

smacdonald2008

Here is an older thread that talks about similar ( HTTPOnly and SECURE FLAG for session cookies):

https://forums.adobe.com/thread/1562784

S

satheeshrajAuthor

In the above provided link there was no clue to set secure flag for 'login-token' cookie and sessionPersistence cookie.

kautuk_sahni

Community Manager

Hi

Please find below some reference article which could come as a help to you:-

Link:- http://help-forums.adobe.com/content/adobeforums/en/experience-manager-forum/adobe-experience-manager.topic.html/forum__x8or-hello_is_itposs.html

// If the request is over https out of the box should be setting the secure flag on all cookies. In case you are terminating SSL on another layers like lb, dispatcher configure Felix SSL Filter. You can also set using api.

https://docs.oracle.com/javase/7/docs/api/java/net/HttpCookie.html

Link :- http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html

Link :- https://blogs.oracle.com/jluehe/entry/ow_to_configure_the_security

I think this come as a help to you.

Thanks and Regards

Kautuk Sahni