HCL Domino Ideas Portal

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Add a new idea Subscribe
Status Needs Review
Workspace Domino
Categories Security
Created by Guest
Created on Oct 25, 2023

RELATED IDEAS

Automatically add "secure" flag to all cookies, when https is used

When a Domino server serves http requests through encrypted https, it should automatically add the "secure" flag to all cookies.

There should be a global flag to enable/disable this feature. (default: enabled)

In reality, most Domino servers with https are missing the "secure" flag for cookies like "SessionID" and maybe even the LTPA token, which should be considered a misconfiguration.


Currently, there are ways to configure it,

The "secure" flag should be set for all cookies (almost) always when https is used, it should be the default, and it should apply to all cookies, including XPages and "SessionID".

The introduction of CertMgr and certstore.nsf has laid a foundation for administrators to use https everywhere in an easily manageable way. There are no more excuses.


[ Toni Feric, Belsoft Collaboration ]

  • Attach files
Copyright © 2023 HCL Technologies Limited