Can't set httpOnly=true for the iPlanetDirectoryPro cookie

[IvanAndrukh]

Describe the bug
I've tried to turn on httpOnly from admin panel(com.sun.identity.cookie.httponly=true) but it doesn't help. How can I set httpOnly to the 'true'?

Expected behavior
HttpOnly flag is turned on for the iPlanetDirectoryPro cookie

Additional context
Here is the screenshot.

[maximthomas]

Seems there is an issue with XUI, it can't create http only cookie by design, I'll try to figure out how to fix this.

[IvanAndrukh]

Please, notify when you resolve this issue.

[akshay141095]

Please notify when the issue is resolved

[vharseko]

XUI, it can't create http only cookie by design

[bhargavabada]

XUI, it can't create http only cookie by design

is there any work around to enable Http Only flag in OpenAM 13.5.2 without disabling XUI .

[maximthomas]

Unfortunately, not yet.

[bhargavabada]

Unfortunately, not yet.
thanks for the quick reply .

[bhargavabada]

Unfortunately, not yet.

Can we set this flag true for federated module authentication . SAML federation does not require XUI interaction . Any enhancement or post Authentication federation module can we set the http only flag .

[vharseko]

use

-Dcom.sun.identity.cookie.httponly=true

[EkaLinMan]

Hi @vharseko @maximthomas, sorry to comment on a closed issue, but I’d like to clarify a few design/behavior questions around cookies in the context of the SAML flows.

Our Environment:
Product: OpenAM 14.6.4 (Open Identity Platform Community)
UI: XUI Interface

Questions:

1. Why does XUI not support HttpOnly?

OIP docs mention that XUI does not currently support HttpOnly cookies. Is it because XUI needs to read/write cookies via JavaScript? Does this limitation also apply to cookies used in SAML SSO/SLO flows when XUI is enabled?

2. You previously suggested using -Dcom.sun.identity.cookie.httponly=true. What exactly does it do, and how should it be applied?

Is it expected to affect cookies set by the server via Set-Cookie, or also cookies that may be written client-side by JavaScript during the SAML SSO/SLO flows? What is the recommended way to apply it (JVM -D vs Server Defaults > Advanced)?

3. Why is iPlanetDirectoryPro missing SameSite even when SameSite is configured?

We configured org.openidentityplatform.openam.cookie.samesite=Strict (OpenAM server property) and also set sameSiteCookies="Strict" in the Tomcat container's context.xml. However, we noticed that in the browser, the SameSite attribute for the iPlanetDirectoryPro cookie still appears empty during the flows. Is this intentional behavior? BTW, the amlbcookie correctly reflects the Strict setting after applying these configurations.

[maximthomas]

1. This is due to the implementation of the admin console. It needs to read cookies using JavaScript.

2. JavaScript cannot set the HttpOnly attribute; this attribute can only be set by server-side cookies.
   JVM -D options have higher priority compared to Server Defaults → Advanced settings.

3. Check the HAR log in your browser. The Set-Cookie header should look something like this:
   iPlanetDirectoryPro=AQIC5wM2LY4Sfcw1vhTGf6uwaD4JDB7ggtPCXMcrQ_ypIRQ.*AAJTSQACMDEAAlNLABQtMTQ4NjQyMzg2Mzg. The SameSite attribute for the iPlanetDirectoryPro cookie could be empty because a browser can ignore this flag for insecure connections. https://mdn2.netlify.app/en-us/docs/web/http/headers/set-cookie/samesite/