What are the Secure, HttpOnly and SameSite cookie attributes?

Short answer

Cookie attributes are flags that are added next to the cookie value in the Set-Cookie header and determine how the browser will use the cookie. Secure ensures that the cookie is sent only over HTTPS connections. HttpOnly prevents the JavaScript on the page from reading the cookie; it makes it harder to steal the session cookie with XSS. SameSite determines whether the cookie is sent in requests initiated from another site (Strict, Lax, None); Strict limits CSRF. In TR7, Mark as Secure, Mark as HttpOnly and Mark as SameSite=Strict are selected in the Cookie Security Options field of the HTTP Cookie Security action; the selected attributes are added to all the Set-Cookie headers in the responses the vService sends; the cookies TR7 adds itself are also included in this. The attributes of the Session Affinity Manager (SAM) cookie that TR7 generates itself are selected separately in the Security Flags field on the vService.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions (Policy Actions) → HTTP Cookie Security action	Cookie Security Options: Mark as Secure, Mark as HttpOnly, Mark as SameSite=Strict (at least one is selected)	Adding attributes to all the cookies in the responses (including the cookies TR7 adds); works only on an HTTP vService and at the response stage
Load Balancer → Load Balancer vService List → HTTP vService form → Persistence: Session Affinity Manager (SAM)	Security Flags: HttpOnly, Secure (HTTPS only), SameSite=Strict, SameSite=Lax (HttpOnly and Secure (HTTPS only) come checked in the form)	The attributes of the SAM cookie that TR7 generates; applied only while Cookie Source = TR7 Generates

Attributes and How They Are Applied in TR7

Attribute	Effect	Risk it protects against	In the HTTP Cookie Security action
Secure	The cookie is sent only over HTTPS	The cookie being read on an unencrypted connection	Added only to the responses of the requests coming over HTTPS; not added if secure appears in the header line
HttpOnly	JavaScript cannot read the cookie	Session theft with XSS	Not added if httponly appears in the header line
SameSite=Strict	The cookie is sent only in requests initiated from the same site	CSRF	The existing SameSite value (Lax, None) is removed, and Strict is written instead

The attributes are defined in the RFC 6265 · Set-Cookie section. Setting up the action: Can I automatically add the Secure, HttpOnly and SameSite attributes to cookies?

Common Misconceptions

• "Secure encrypts the cookie." Secure only prevents the cookie from being sent over an unencrypted connection; the value remains readable in the browser. To encrypt the value, the Cookie Encryption action is used.
• "The HTTP cookie security action can also add Lax for SameSite." The action writes only SameSite=Strict, and it replaces the existing SameSite value in the cookie with Strict. If the cookie needs to be sent on pages opened through links coming from another site or in SSO flows, this option is not checked.
• "The action affects only the Backend Service's cookies." The action runs just before the response leaves TR7; the cookies TR7 adds itself (the SAM and persistence cookies, the CAPTCHA cookie) are covered too. The attributes of the SAM cookie are selected in the Security Flags field on the vService; SameSite=Lax exists only in this field, but if Mark as SameSite=Strict is selected on the same vService, this value is also replaced with Strict.

How it is done in the documentation

• HTTP Cookie Security · Cookie Security Options
• HTTP Cookie Security · Supported Security Attributes
• HTTP (L7) vService · Security Flags
• Cookie Encryption

Related questions

• Can I automatically add the Secure, HttpOnly and SameSite attributes to cookies?
• What is a cookie; what is the difference between the Cookie and Set-Cookie headers?
• What are HTTP security headers?