As per my security checking and testing in Magento 2, I see that secure cookie or HTTP only flag not set on the Magento 2.

For the security reason, we need the cookie to be secure. Can someone please help me on this.

  • have you configure Cookies from admin ? Commented May 28, 2018 at 10:50
  • Yes, I have configured all the required configuration related to the cookie.
    – rajat kara
    Commented May 28, 2018 at 13:15

3 Answers 3


Go to

Stores > Configuration > (General) > Web > Default Cookie Settings

enter image description here

Cookie Lifetime. It’s how long Cookie files stay on user’s computer. By default it’s set as 3600 seconds which is equal to about 1 hour. If you want to ensure that cookies expire when a user closes their browser, then select 0 here.

Cookie Path. To make cookies available for some particular folders, enter the Cookie Path here. If you want them to be available anywhere on your site, then enter a “/”.

Cookie Domain. If you want to enable cookies for a subdomain, enter it here. If you want to enable cookies for all subdomains, enter something like “.domain.com” (make sure there is a “.” before your domain name).

Use HTTP Only. To prevent your store from Malware, select “Yes” here. It uses HTTP protocol only and doesn’t allow other protocols such as JavaScript. Cookie Restriction Mode. You need to select “Yes” here.

  • I Have set all the required configuration but in some URLs like yourdomainname.com/sales/order/history the secure cookie is not set.
    – rajat kara
    Commented May 28, 2018 at 12:30
  • but its not working, still domain is not showing secured/HttpOnly flag Commented Jan 27, 2020 at 5:21
  • @PraveenNegimani : I am also facing same problem. Did you get any solution? Commented Jun 15, 2021 at 12:56

Magento doesn't have specific configuration for this but there is a logic in Session config files. If your secure and unsecure urls are equal (and https of course), magento sets the cookies as secure as OOB.


    $secureURL = $this->_scopeConfig->getValue('web/secure/base_url', $this->_scopeType);
        $unsecureURL = $this->_scopeConfig->getValue('web/unsecure/base_url', $this->_scopeType);
        $isFullySecuredURL = $secureURL == $unsecureURL;
        $this->setCookieSecure($isFullySecuredURL && $this->_httpRequest->isSecure());

So if you set web/secure/base_url and web/unsecure/base_url same like https://example.com/ then it'll set your cookies as secure.

Related Config paths

Stores > Configuration > (General) > Web > Base URLs (Secure) > Base URL Stores > Configuration > (General) > Web > Base URLs > Base URL


As the other answer says, for HTTP only, you'll find the option here:

Stores > Configuration > (General) > Web > Default Cookie Settings

For setting the secure attribute, you can go to the following page and make sure that both the Secure and Unsecure Base URLs are the same and that they both use https://

Admin > Stores > Configuration > Web

Alternatively, you can also override setCookieSecure() in Magento\Framework\Session\Config so that it always sets secure as true.

class Config extends \Magento\Framework\Session\Config
    public function setCookieSecure($cookieSecure)
        $this->setOption('session.cookie_secure', true);
        return $this;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.