# Cookies without the "HTTPOnly & Secure" Attribute

**URL:** <https://developer.sailpoint.com/discuss/t/cookies-without-the-httponly-secure-attribute/95958>\
**Category:** IIQ Discussion and Questions\
**Tags:** data-access-security, identityiq\
**Created:** [January 6, 2025, 7:33am UTC](https://developer.sailpoint.com/discuss/t/cookies-without-the-httponly-secure-attribute/95958 "2025-01-06T07:33:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kchengalvarayan](https://avatars.discourse-cdn.com/v4/letter/k/48db29/32.png) [@kchengalvarayan](https://developer.sailpoint.com/discuss/u/kchengalvarayan)\
**Post date:** [January 6, 2025, 7:33am UTC](https://developer.sailpoint.com/discuss/t/cookies-without-the-httponly-secure-attribute/95958/1 "2025-01-06T07:33:39Z")

</div>

## Which IIQ version are you inquiring about?

8.3p1

## Please share any images or screenshots, if relevant.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/a/e/aec91b3753c31a4bcb6df12eba48d40023efe620.png)

## Share all details about your problem, including any error messages you may have received.

Cookies have been found not to contain the “HTTPOnly” attribute.  
Cookies without the “HTTPOnly” attribute are allowed to be accessed via JavaScript,  
and therefore Cross-site scripting attacks can steal them, which could lead to user  
impersonation or compromise of the application account

Cookies have been found not to contain the “Secure” attribute.  
Cookies with the “Secure” attribute are only permitted to be sent via HTTPS. Cookies  
sent via HTTP expose an unsuspecting user to sniffing attacks that could lead to user  
impersonation or compromise of the application account.

In the current assessment, the Vulnerability team has been able to identify that some of the  
cookies implemented do not contain the “HTTPOnly” & “Secure” attribute and could lead to session hijacking attacks and sniffing attacks.

Could you please help us add these into SailPoint Environment.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [March 7, 2025, 7:34am UTC](https://developer.sailpoint.com/discuss/t/cookies-without-the-httponly-secure-attribute/95958/2 "2025-03-07T07:34:24Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.