# Cookie Does Not Contain The ¨secure¨ Attribute in SaaS

**URL:** <https://community.dynatrace.com/t/cookie-does-not-contain-the-secure-attribute-in-saas/20610>\
**Category:** Real User Monitoring\
**Tags:** data-privacy-and-product-security, user-sessions\
**Created:** [May 9, 2019, 10:09pm UTC](https://community.dynatrace.com/t/cookie-does-not-contain-the-secure-attribute-in-saas/20610 "2019-05-09T22:09:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![porrasmj](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@porrasmj](https://community.dynatrace.com/u/porrasmj)\
**Post date:** [May 9, 2019, 10:09pm UTC](https://community.dynatrace.com/t/cookie-does-not-contain-the-secure-attribute-in-saas/20610/1 "2019-05-09T22:09:15Z")

</div>

Hi.

We are working with Dynatrace Saas, with **OneAgent  
version 1.157.201.20181211-092722**

The security department of our  
company found a warning security risk.

Cookie Does Not Contain The  
¨secure¨ Attribute

Impact: Cookies with “secure”  
attribute are one permitted to be sent via HTTPS. Cookies sent via HTTP expose  
an unsuspecting user to sniffing attacks that could lead to user impersonation  
or compromise of the application account.

HTTP Cookie missing Secure  
attribute on port 443.

Set-Cookie:  
dtCookie==3=srv=3=sn=3A695446E5F92C0A76D24CFC824D60B4=perc=100000=ol=0=mul=1;  
Path=/

**Could anybody please tell us  
if there is an option we could configure to avoid this warning?**

I have seen something similar  
but in AppMon

---

<div class="post-metadata">

**Author:** ![skrystosik](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/skrystosik/32/21133_2.png) [@skrystosik](https://community.dynatrace.com/u/skrystosik)\
**Post date:** [May 10, 2019, 6:56am UTC](https://community.dynatrace.com/t/cookie-does-not-contain-the-secure-attribute-in-saas/20610/2 "2019-05-10T06:56:40Z")

</div>

Go to Application settings =\> Advanced:

 ![20478-zrzut-ekranu-2019-05-10-o-085602.png](https://global.discourse-cdn.com/dynatrace/original/2X/2/2155c7adff5b7c60b48ae4630a1419629a4cdd17.png)

Here is option you need.

Sebastian

---

<div class="post-metadata">

**Author:** ![porrasmj](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@porrasmj](https://community.dynatrace.com/u/porrasmj)\
**Post date:** [May 23, 2019, 4:06pm UTC](https://community.dynatrace.com/t/cookie-does-not-contain-the-secure-attribute-in-saas/20610/3 "2019-05-23T16:06:42Z")

</div>

We already set the set the attibute to our application but the the result scan still says the cookie is not secured.

 ![20628-dtcookienotsecured.jpg](https://global.discourse-cdn.com/dynatrace/original/3X/f/2/f28314effc83504f5b6258eb054681201327d00b.jpeg)

Please anwser the two questions:

Q1. Is there any something else we should configure? Maybe in the two host of our dmz cluster?

Q2. Our two dmz host have the latest available version : OneAgent version 1.167.176.20190508-104947, however, the **Cookie and header settings** requires OneAgent version 1.87 or highter

 ![20629-cookiechecksetted.jpg](https://global.discourse-cdn.com/dynatrace/original/3X/f/a/fa8322d8dee860b897bc8ae1c6ffe9c02e8492fe.jpeg)

**but** the point is the latest version available for us is 1.167…

So I think something is wrong: or the label which ask 1.87 version or why we only can see until 1.167 version…

Thanks a lot.

---

<div class="post-metadata">

**Author:** ![skrystosik](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/skrystosik/32/21133_2.png) [@skrystosik](https://community.dynatrace.com/u/skrystosik)\
**Post date:** [May 23, 2019, 6:30pm UTC](https://community.dynatrace.com/t/cookie-does-not-contain-the-secure-attribute-in-saas/20610/4 "2019-05-23T18:30:27Z")

</div>

1.167 is grater version than 1.87 🙂 If after reconfiguration cookie is still unsecure make sure that this applications covers all requests that you are talking about. If you have more than one application or there are some requests in default one it is possible that there are some of them without secure parameter. If not, open support ticket and put link to this questions.

Sebastian