Configuring HttpOnly Session Cookies

Whether you use HTTP or HTTPS, flag your cookies as HttpOnly, which means they are transmitted only over HTTP or HTTPS protocols. This setting alone already prevents most XSS attacks, since HttpOnly cookies cannot be transmitted using JavaScript.

Important

When a client makes a call to the /json/authenticate endpoint appending a valid SSO token, AM returns the tokenId field empty when HttpOnly cookies are enabled. For example: 

{
    "tokenId":"",
    "successUrl":"/openam/console",
    "realm":"/"
}
To Configure the HttpOnly Flag

  1. Log in to the AM console as an administrative user, for example, amAdmin.

  2. Navigate to Configure > Server Defaults > Advanced.

  3. Set the com.sun.identity.cookie.httponly advanced server property to true, and save your changes.

    You must make this change in all the AM instances on the site.

    Note

    Regardless of the value of the com.sun.identity.cookie.httponly property, AM upgrades cookies to secure cookies (except the amlbcookie cookie) when requests arrive over a secure channel.

  4. Restart AM or the container where it runs.

Read a different version of :