As per my security checking and testing in Magento 2, I see that secure cookie or HTTP only flag not set on the Magento 2.

For the security reason, we need the cookie to be secure. Can someone please help me on this.

  • have you configure Cookies from admin ? – Aditya Shah May 28 '18 at 10:50
  • Yes, I have configured all the required configuration related to the cookie. – rajat kara May 28 '18 at 13:15

Go to

Stores > Configuration > (General) > Web > Default Cookie Settings

enter image description here

Cookie Lifetime. It’s how long Cookie files stay on user’s computer. By default it’s set as 3600 seconds which is equal to about 1 hour. If you want to ensure that cookies expire when a user closes their browser, then select 0 here.

Cookie Path. To make cookies available for some particular folders, enter the Cookie Path here. If you want them to be available anywhere on your site, then enter a “/”.

Cookie Domain. If you want to enable cookies for a subdomain, enter it here. If you want to enable cookies for all subdomains, enter something like “.domain.com” (make sure there is a “.” before your domain name).

Use HTTP Only. To prevent your store from Malware, select “Yes” here. It uses HTTP protocol only and doesn’t allow other protocols such as JavaScript. Cookie Restriction Mode. You need to select “Yes” here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.