# Cookies Not Marked as Secure and Cookies Not Marked as HttpOnly **URL:** \ **Category:** Get Help\ **Tags:** security-compliance, security-question-concern\ **Created:** [February 27, 2023, 9:57am UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353 "2023-02-27T09:57:13Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![robert.smith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robert.smith/32/71444_2.png) [@robert.smith](https://community.auth0.com/u/robert.smith)\ **Post date:** [February 27, 2023, 9:57am UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353/1 "2023-02-27T09:57:13Z")
Following a Pen test on our application which is using the Auth0 SPA SDK (Angular), the following Cookies are flagging up as not being marked as secure and not being marked as HTTPOnly. Appreciate that the latter is because the cookie needs to accessible in JS but just wanted to confirm this and that the same applies for the “Secure” setting ? -The following cookies are not set with the HTTPOnly or secure attribute: - auth0.organization\_hint - \_legacy\_auth0.organization\_hint - auth0.is.authenticated - \_legacy\_auth0.is.authenticated Basically I need to know if this is an issue that we can resolve or if its a risk we’ll need to sign off on due to the way our application uses Auth0. ---
**Author:** ![robert.smith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robert.smith/32/71444_2.png) [@robert.smith](https://community.auth0.com/u/robert.smith)\ **Post date:** [August 28, 2024, 8:15am UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353/2 "2024-08-28T08:15:08Z")
Bumping this again as its appeared in another yearly security scan. its specifically the “Secure” setting on the Auth0 cookies I am querying. I understand the reasoning for HTTPOnly and can justify that being risk accepted. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 7, 2025, 9:05pm UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353/4 "2025-03-07T21:05:44Z")
Hi @robert.smith Welcome to the Auth0 Community! I am sorry about the late reply to your post! We do not recommend to set cookies with the `HttpOnly` attribute since that might not allow JS to read them and may interfere with your authentication process. Regarding the `Secure` attribute, we highly recommend to set it to true due to the fact that it prevents the cookie to be sent over insecure connections. Basically, it prevents the cookie to be stolen by an attacker which allows them to impersonate and hijack the user’s session and can lead to other vulnerabilities. Hope this helps! If you have any other questions, feel free to leave a reply or post again on the community! Kind Regards, Nik ---
**Author:** ![robert.smith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robert.smith/32/71444_2.png) [@robert.smith](https://community.auth0.com/u/robert.smith)\ **Post date:** [March 12, 2025, 12:07pm UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353/5 "2025-03-12T12:07:41Z")
Hi, Thanks for confirming on the HttpOnly setting. I can risk accept that finding. Yes I agree with the secure setting but these cookies are generated by Auth0 so I was wondering why they aren’t set with the Secure flag and if its possible for us to configure that to be set in these cookies ? Thanks, Rob ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 12, 2025, 8:53pm UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353/6 "2025-03-12T20:53:56Z")
Hi again @robert.smith Due to the fact that these cookies do not hold sensitive information, it is not necessary to set the **`Secure`** flag to **`true`** since the **`auth0.is.authenticated`** cookie is only used to remember the authentication state with Auth0 across multiple page tabs and page refreshes. For the **`auth0.organization_hint`** cookie, it is used to keep track of the organization ID. If the cookie was stored and the application did not pass the organization ID in the next login attempt, the SDK retrieves the organization ID from the stored cookie while [generating the **`/authorize`** call for silent authentication calls during fallback, where using the rotational refresh tokens wasn’t possible. Unfortunately, you are unable to configure cookie flags and update them accordingly. If this poses an issue to your implementation, you can always let us know or post again on the community regarding the matter. If you have any other questions, feel free to leave a reply! Kind Regards, Nik ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 26, 2025, 8:54pm UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353/7 "2025-03-26T20:54:41Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.