Capability

Cookie Security Flags

Complete missing cookie flags on legacy applications at runtime — strengthen browser-side session security without touching application code.

TR7 Cookie Security Flags inspects Set-Cookie headers returned by the backend and adds missing security flags at the response stage. HttpOnly, Secure and SameSite policies can be enforced at the ADC/WAAP layer without modifying a single line of application code. This approach is especially valuable for legacy applications. An application may already produce session cookies but omit HttpOnly, forget the Secure flag, or fail to configure SameSite in line with modern browser expectations. TR7 corrects these gaps on the response and makes session cookies more secure. Policy can be applied globally to all cookies or scoped to specific cookie names. The SameSite value can be set to Strict, Lax or None; Secure and HttpOnly can be made mandatory. The result is both improved browser compatibility and more controlled cookie behaviour against XSS and cross-site request risks. TR7 turns cookie security from a fragile task that every development team must code independently into a centralised, consistent, rule-based response security policy.

3
Security flags: HttpOnly, Secure, SameSite
3
SameSite policy options: Strict, Lax, None
0
Application code changes required

When session cookies carry the wrong flags, session security is weak even if authentication succeeds.

Many legacy applications produce session cookies but leave HttpOnly, Secure or SameSite flags incomplete. The gap looks small, but its impact on the browser side is significant. Cookies readable by JavaScript become targets in XSS attacks; cookies that can travel over non-HTTPS connections create risk on the network; cookies without a SameSite policy may be sent unnecessarily in cross-site flows.

Fixing this in application code is not always straightforward. Organisations run dozens of legacy applications across different frameworks, different development teams and different release cycles. A simple Set-Cookie change can require regression testing, a formal change process and a maintenance window.

Because modern browsers interpret SameSite behaviour more strictly, outdated cookie policies create not only security problems but also compatibility issues. Specifically in applications using third-party integrations, payment flows, SSO and iframes, an incorrect SameSite value can cause sessions to drop unexpectedly or remain more open than intended.

The right approach is to inspect cookies leaving each application at a central point and consistently complete missing security flags at the response stage. Instead of waiting for separate code changes from every application team, the ADC/WAAP layer applies the shared cookie standard.

TR7 Cookie Security Flags delivers this model: it enforces HttpOnly, Secure and SameSite policies on the response without touching application code.

Our approach

TR7 reads cookie security flags at the response stage and completes them through a global or per-cookie policy.

Set-Cookie responses are inspected at the response stage

TR7 checks Set-Cookie headers returned by the backend after they leave the application. Missing HttpOnly, Secure or SameSite flags can be added according to the configured policy.

HttpOnly and Secure flags are enforced centrally

HttpOnly helps prevent client-side scripts from reading the cookie value. The Secure flag ensures the cookie is sent only over secure connections.

SameSite policy is selected as Strict, Lax or None

SameSite behaviour can be tuned to the application's flow. Strict is the most restrictive, Lax is a balanced default for most web applications, and None is available for integrations that require a third-party context.

Global or per-cookie application flexibility is provided

Policy can be applied to all cookies or scoped to specific cookie names only. This allows session cookies to be hardened while integration cookies retain different behaviour.

Capabilities

Cookie Security Flags deliver modern cookie security and browser compatibility without touching application code.

HttpOnly enforcement makes cookies harder for JavaScript to read

The HttpOnly flag helps prevent browser-side scripts from accessing the cookie value. TR7 can add this flag at the response stage if it is absent from the Set-Cookie header returned by the backend. This matters especially for cookies carrying session IDs. It does not eliminate XSS entirely, but it reduces the risk of session cookies being read directly.

Secure enforcement ensures cookies are carried only over secure connections

Cookies with the Secure flag are sent only over HTTPS connections. Legacy applications may forget to add this flag because TLS termination happens at the ADC layer. TR7 can enforce the Secure flag centrally for services published over TLS. Even if application code remains unchanged, browser-side cookie transport behaviour aligns with modern security expectations.

SameSite Strict, Lax and None options allow flow-appropriate policy

SameSite controls how a cookie is sent in cross-site requests. Strict offers the most restrictive behaviour; Lax can serve as a balanced default for most web applications; None is needed for third-party contexts or certain SSO flows. TR7 can add or correct the SameSite value as a centralised policy. Operators balance security and application compatibility on a per-service basis.

Missing flags are completed without changing backend code

TR7 handles cookie security at the response rewrite level. The application produces the Set-Cookie header; TR7 reads it and adds any missing security flags. This model provides fast improvement on legacy applications. The operations team can apply a central security standard without waiting for development releases.

Per-cookie targeting gives critical session cookies dedicated protection

Applying the same policy to every cookie may not be appropriate in all applications. TR7 can target specific cookie names and add security flags only to critical cookies such as session, auth or sticky cookies. This prevents integration or analytics cookies from breaking unexpectedly. Critical session cookies can be hardened while auxiliary cookies remain more flexible.

Global enforcement standardises all response cookies

Organisations that need a common security standard across all cookies can use global enforcement. In this mode, Set-Cookie headers are made consistent through a shared policy. This provides fast baseline security, especially in environments with many legacy applications. Operators do not need to correct each application's cookie behaviour individually.

Modern browser compatibility makes SameSite behaviour predictable

Browsers interpret the SameSite and Secure relationship more strictly. Behaviours such as the Secure requirement for SameSite=None cookies can affect application flows. TR7 manages cookie flags centrally, making browser compatibility more predictable. Incorrect cookie behaviour in SSO, payment and iframe scenarios becomes easier to control.

Conditional enforcement with the traffic rules engine

The cookie security flag action can be used as part of the traffic rules engine. This allows cookie policy to be applied based on specific host, path, vService or other conditions. For example, stricter SameSite can be set on admin paths while different behaviour is preferred on public paths. Security policy becomes context-aware rather than one-dimensional.

Combined with cookie encryption, session cookie protection is strengthened

Cookie security flags govern transport and access behaviour in the browser. Cookie encryption reduces the readable meaning of the cookie value from the client side. When used together, the session cookie is both securely transported and protected in terms of content. This provides a layered approach to session security.

Combined with session protection, the impact of session theft is reduced

Cookies secured with the correct flags become more effective alongside session protection policies. While HttpOnly and Secure reduce the cookie leakage surface, session binding or anomaly controls can limit the use of a stolen session. This approach moves cookie security beyond header manipulation alone. Session integrity is connected to a broader access security chain.

Operational depth

Cookie security flags operate together with response-stage processing, Set-Cookie handling, SameSite compliance, conditional enforcement and audit visibility.

01

Response stage processing

Cookie security flags are applied to the response returned by the backend. They run after the Set-Cookie header is produced, not at the request stage. This means they can be applied without touching application code or framework settings.

02

Set-Cookie handling

TR7 reads Set-Cookie headers and can complete missing flags in line with the configured policy. Existing flags can be preserved or corrected if the policy requires it. Each cookie is evaluated individually in responses that carry multiple Set-Cookie headers.

03

SameSite None compliance

For cookies using SameSite=None, the Secure flag becomes critical for modern browsers. TR7 can handle this relationship as a centralised policy. This reduces application breakage in SSO or payment integrations that require a third-party context.

04

Per-cookie scope

Policy can be applied to specific cookie names. This scope helps separate session cookies from auxiliary cookies. It prevents integration cookies from breaking due to an incorrectly applied global policy.

05

Conditional enforcement

Cookie security flags can be applied based on host, path, vService or other traffic conditions. This allows different cookie security behaviour to be configured for different parts of an application. Stricter policy is particularly useful on admin, payment and user account pages.

06

Audit and visibility

Cookie security policy changes can be included in centralised configuration and audit workflows. The question of who mandated which cookie flag for which vService can be tracked. This is important for compliance and change management purposes.

When to use it

Complete a missing HttpOnly flag on a legacy application

A legacy application produces session cookies but does not add HttpOnly. TR7 adds the missing flag on the response, reducing the risk of the cookie being read after an XSS attack.

Centrally enforce the Secure flag on HTTPS services

When TLS termination happens at TR7, the application may forget to add the Secure flag. TR7 adds it centrally, ensuring the cookie travels only over secure connections.

Configure SameSite policy correctly for SSO flows

Some cookies in SSO and federation flows need to be sent in a cross-site context. TR7 can apply SameSite=None and the Secure flag together in a controlled way.

Apply stricter cookie policy on payment pages

Session cookies on checkout or payment paths can be hardened with Strict or Lax behaviour. Applying this policy only to critical paths strengthens security without disrupting the general application flow.

Build layered session security with cookie encryption

Cookie security flags govern browser behaviour while cookie encryption protects the cookie value. Used together, the session cookie is more strongly protected both in transport and in content.

Frequently asked questions

At which stage are cookie security flags applied?
Flags are applied to the response returned by the backend, after the Set-Cookie header has been produced. They run at the response stage, not the request stage. This means they can be deployed without touching application code or framework settings.
Does the HttpOnly flag fully prevent XSS attacks?
HttpOnly helps prevent browser-side scripts from accessing the cookie value. This reduces the risk of session cookies being read directly even if an XSS attack occurs. However, it does not eliminate the XSS attack itself. It should be considered alongside other measures such as secure coding practices at the application layer and client-side script protection.
What should be considered when selecting SameSite=None?
Modern browsers require the Secure flag alongside SameSite=None. If both are missing, the cookie will not be sent by most browsers. TR7 can handle this relationship as a centralised policy, enforcing both SameSite=None and Secure together. This is particularly important for third-party integrations and SSO flows.
How do I choose between global enforcement and per-cookie enforcement?
Global enforcement provides a fast security baseline when all cookies need to meet the same standard. If the application includes cookies with different requirements — such as integration, analytics or preference cookies — per-cookie targeting is more appropriate. TR7 supports both models; operators can harden critical session cookies while leaving auxiliary cookies under a different policy.
Are existing cookie flags preserved or overwritten?
TR7 reads the Set-Cookie header returned by the backend and adds missing flags. Existing flags can be preserved or overwritten depending on the configured policy behaviour. This flexibility can be tuned to the requirements of each environment.
Can cookie security flags be used together with the traffic rules engine?
Yes. The cookie security flag action can be defined as part of the traffic rules engine. This allows cookie policy to be applied based on specific host, path or vService conditions. For example, Strict can be preferred on admin and payment paths, while Lax can be used in the general user flow.

Make cookie security independent of application code

Enforce HttpOnly, Secure and SameSite flags with centralised policy at the ADC/WAAP layer. Let's walk through a live setup on your own services.