# Security scan warning: com.auth0.state cookie not Secure — expected behavior?

**URL:** <https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844>\
**Category:** Get Help\
**Tags:** security-compliance, security-question-concern\
**Created:** [August 20, 2025, 9:19pm UTC](https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844 "2025-08-20T21:19:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul.stypula](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/paul.stypula/32/60368_2.png) [@paul.stypula](https://community.auth0.com/u/paul.stypula)\
**Post date:** [August 20, 2025, 9:19pm UTC](https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844/1 "2025-08-20T21:19:19Z")

</div>

The `com.auth0.state` cookie has been flagged by our security scans for missing the `Secure` attribute. It is set by Auth0 during the redirect to `/authorize`. I previously found a post discussing other cookies not being marked `Secure` as a design decision, but it didn’t mention `com.auth0.state` specifically. The cookies referenced were:

- `auth0.organization_hint`
- `_legacy_auth0.organization_hint`
- `auth0.is.authenticated`
- `_legacy_auth0.is.authenticated`

Does the answer in that thread also apply to the `com.auth0.state` cookie?

Is there a way to ensure this cookie is set with the `Secure` attribute, or is this a warning that can be safely ignored for now?

**Note:** All requests are over HTTPS.

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [August 25, 2025, 3:16pm UTC](https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844/3 "2025-08-25T15:16:13Z")

</div>

Hi @paul.stypula

I am sorry about the delayed response to your inquiry!

I understand that any information regarding the `com.auth0.state` cookie might not be available at this time, however, the cookie behaves similarly to the ones you have mentioned above.

The cookie itself is short-lived and it is used exclusively during the authentication flow to prevent [CSRF attacks](https://auth0.com/blog/cross-site-request-forgery-csrf/). The cookie itself does not contain sensitive user information and it is being set that way by Auth0. Even if marking cookies as `Secure` is a common practice, it is not necessary for this specific cookie in order to accomplish its functions and to operate in an HTTPS only flow.

As you have mentioned above, the reason the cookie would be set this way is purely by design and it can be safely ignored since it won’t affect your application. Otherwise, I would suggest to not attempt to set this cookie manually as tampering with it might affect the authentication process of your application.

If you have any other questions, let me know!

Kind Regards,

Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 8, 2025, 3:17pm UTC](https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844/4 "2025-09-08T15:17:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.