Can I automatically add the Secure, HttpOnly and SameSite attributes to cookies?

Short answer

Yes, on the HTTP vService, with the HTTP Cookie Security action. Mark as Secure, Mark as HttpOnly and Mark as SameSite=Strict are selected from the Cookie Security Options list; the attributes are added to all the Set-Cookie headers in the response. Secure is added only in HTTPS responses; the SameSite option replaces the existing SameSite value in the cookie with Strict. For a different value such as SameSite=Lax, or only for a specific cookie, Replace HTTP Header Content is used; the flags of TR7's own session persistence cookies are managed from the Security Flags or Cookie Based Connection Persistency settings.

Problem: The Application's Cookies Do Not Carry Security Attributes

If the Secure, HttpOnly and SameSite attributes are missing from session cookies, the cookies can be sent over an unencrypted connection, can be read by the scripts on the page and can be used in cross-site requests. Security audits require these attributes to be added; the application code cannot always be changed.

Solution: Three Methods

Your situation	Suitable method
Adding Secure, HttpOnly, SameSite=Strict to all cookies	Method 1: HTTP Cookie Security
A different value such as SameSite=Lax, or only a single cookie	Method 2: Replace HTTP Header Content
The cookie that TR7 adds for session persistence	Method 3: Security flags / Cookie Based Connection Persistency

Method 1: HTTP Cookie Security Recommended

• How it works The selected attributes are added to the Set-Cookie headers in all the responses leaving TR7; if the cookie already has Secure or HttpOnly, it is not added a second time, and the existing SameSite value is replaced with Strict. The action does not take a condition.
• Where it is openedLoad Balancer → Actions → HTTP Cookie Security → Cookie Security Options
• Requirement At least one selection
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked (how to add).

2

Adım 2 Check the attributes

Action Name is entered, and Action Type = HTTP cookie security is selected. Mark as Secure, Mark as HttpOnly and Mark as SameSite=Strict are checked in the Cookie Security Options list (how the attributes are applied).

3

Adım 3 Save the action

Add is clicked.

4

Adım 4 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

5

Adım 5 Add the action to the Actions field

The action is selected in the Details → Actions field.

6

Adım 6 Save

Save is clicked. The change is applied without dropping open connections; in a cluster, it is also sent to the peer device with the default auto-sync (if Manual Sync Mode is on, with Synchronize).

The result in HTTPS responses while the three options are checked together:

Set-Cookie sent by the Backend Service	Set-Cookie received by the client
SESSIONID=abc; Path=/	SESSIONID=abc; Path=/; Secure; HttpOnly; SameSite=Strict
SESSIONID=abc; Path=/; Secure	SESSIONID=abc; Path=/; Secure; HttpOnly; SameSite=Strict
lang=tr; HttpOnly	lang=tr; HttpOnly; Secure; SameSite=Strict
secure_token=1; Path=/	secure_token=1; Path=/; HttpOnly; SameSite=Strict (Secure is not added because secure occurs in the name of the cookie)

Verification

1ResponseClient side

curl -skI https://www.example.com/ | grep -i set-cookie

Expected; Secure; HttpOnly; SameSite=Strict

2BrowserClient side

In the browser's developer tools, the flags of the cookie are seen in the Application/Storage → Cookies section.

ExpectedSecure ✓ · HttpOnly ✓ · SameSite Strict

Method 2: Replace HTTP Header Content

• How it works The Set-Cookie header is rewritten with a regex; only the cookie that matches the pattern (e.g. SESSIONID) changes, and the desired SameSite value is written.
• Where it is openedLoad Balancer → Actions → Replace HTTP Header Content
• Requirement The pattern is case-sensitive; Match type = Replace whole header
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Define the action that removes the existing SameSite

Action Name is entered, and Action Type = Replace HTTP header content is selected: Execution Level = On response, Header to Replace = Set-Cookie, Regex to Match = ^(SESSIONID=.*); *SameSite=[A-Za-z]+(.*)$, Match Type = Replace whole header (default; since the dates in the Set-Cookie value contain commas, the option that splits by comma is not used), Replacement Content = \1\2. The pattern is case-sensitive; if the Backend Service writes the attribute differently, such as samesite=, the pattern is set up with the same spelling. If the Backend Service does not add SameSite to the cookie at all, this action is skipped.

3

Adım 3 Save the action

Add is clicked.

4

Adım 4 Open the second action form

Load Balancer → Actions → Add is clicked.

5

Adım 5 Define the action that adds SameSite=Lax

Action Name is entered, and Action Type = Replace HTTP Header Content is selected; Execution Level = On response, Header to Replace = Set-Cookie, Regex to Match = ^(SESSIONID=.*)$, Replacement Content = \1; SameSite=Lax (cookie scenario).

6

Adım 6 Save the action

Add is clicked.

7

Adım 7 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

8

Adım 8 Add the actions to the Actions field

In the Details → Actions field, first the removing action and then the adding action is selected.

9

Adım 9 Save

Save is clicked.

The result of the two actions with the example values:

Set-Cookie	Result
SESSIONID=abc; Path=/; HttpOnly	SESSIONID=abc; Path=/; HttpOnly; SameSite=Lax
SESSIONID=abc; SameSite=None; Secure	SESSIONID=abc; Secure; SameSite=Lax
lang=tr; Path=/, XSESSIONID=1	Unchanged (the pattern looks for SESSIONID= at the beginning)

Verification

1ResponseClient side

curl -skI https://www.example.com/giris | grep -i set-cookie

ExpectedSESSIONID=…; SameSite=Lax (single SameSite)

Method 3: TR7's Session Persistence Cookie

• How it works The flags of the cookie that TR7 adds itself for session persistence are selected in the setting that creates this cookie.
• Where it is opened vService → Session Affinity Manager (SAM) → Security Flags · Actions → Cookie Based Connection Persistency
• Requirement A vService that uses cookie-based session persistence
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the setting that creates the cookie

If SAM is used, the vService is opened with Edit and the Session Affinity Manager (SAM) section is opened; if Cookie Based Connection Persistency is used, the action is opened with Edit on the Load Balancer → Actions screen.

2

Adım 2 Select the flags

In SAM, HttpOnly, Secure (HTTPS only), SameSite=Strict or SameSite=Lax is selected in the Security Flags field. In Cookie Based Connection Persistency, Mark as Secure and Mark as Only HTTP are checked (What is Session Affinity Manager (SAM); how is it different from classic cookie persistence?).

3

Adım 3 Save

Save is clicked in the vService form, and the Edit button at the bottom of the form is clicked in the action edit form.

Verification

1ResponseClient side

curl -skI https://www.example.com/ | grep -i set-cookie

ExpectedThe selected flags on the persistence cookie

Common Mistakes

• Expecting Secure in HTTP responses. Secure is added only in HTTPS responses.
• Assuming that the Lax or None value will be preserved. Mark as SameSite=Strict replaces the existing SameSite value with Strict; for a different value, Method 2 is used.
• Assuming that SameSite=Strict suits every application. Strict does not send the cookie on links coming from other sites; it can break flows such as single sign-on (SSO) and payment returns. Lax is selected for these flows.
• Expecting flags on cookies whose name contains secure or httponly. If HTTP Cookie Security finds one of these words in the Set-Cookie value, it assumes that the related flag already exists; for these cookies, the flag is added with Method 2.
• Selecting a matching that splits by comma for Set-Cookie. The Expires date contains a comma; in Replace HTTP Header Content, Match type = Replace whole header is used.
• Confusing it with Cookie encryption. Cookie encryption encrypts the value of the cookie; it does not add attributes.

How it is done in the documentation

• HTTP Cookie Security · Cookie Security Options
• HTTP Cookie Security · How the Attributes Are Applied
• Replace HTTP Header Content · Match Type
• HTTP vService · Security Flags

Related questions

• Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?
• Can I change a header value with a regex?
• What is Session Affinity Manager (SAM); how is it different from classic cookie persistence?