In scanning a Drupal 7 site with Qualys, we're getting the issue

150122 Cookie Does Not Contain The "secure" Attribute

Is there a way to systematically add the Secure vs HTTPOnly flag to cookies? Would Secure Cookie Data serve this? If so, how do I test that Cookies are secure?

Moreover, this site automatically forwards to https. The user spends no time over port 80 but instead is directly shuttled to 443. We have an administrator who wants nothing but to see this test passed; regardless of the previous fact.

The Cookie in Question:


enter image description here

Would the following in settings.php be sufficient:

ini_set('session.cookie_secure', 1);
ini_set('session.cookie_httponly', 1);

2 Answers 2


Which cookie is this? All of Drupal 8's cookies are secure.

The exception is BigPipe's no-JS cookie, see https://www.drupal.org/node/2678628 — but there are no security consequences there.

If that's the one that is triggering this alert, then the problem is clear: your security testing tool is making blanket statements that don't make sense.

  • I've adjusted my question to denote Drupal 7.
    – Rick
    Commented Mar 16, 2016 at 17:00
  • I just got this finding from our security scan on Drupal 8 also.
    – zkent
    Commented Oct 22, 2018 at 17:04

It appears I can tell Apache to do this for me:

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

enter image description here

  • 1
    Can you please elaborate how you did it? Commented Dec 4, 2020 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.