Setting secure cookies In scanning a Drupal 7 site with Qualys, we're getting the issue 


  150122 Cookie Does Not Contain The "secure" Attribute


Is there a way to systematically add the Secure vs HTTPOnly flag to cookies? Would Secure Cookie Data serve this? If so, how do I test that Cookies are secure? 

Moreover, this site automatically forwards to https. The user spends no time over port 80 but instead is directly shuttled to 443. We have an administrator who wants nothing but to see this test passed; regardless of the previous fact. 

The Cookie in Question:

has_js=1



Would the following in settings.php be sufficient:

ini_set('session.cookie_secure', 1);
ini_set('session.cookie_httponly', 1);
Which cookie is this? All of Drupal 8's cookies are secure.

The exception is BigPipe's no-JS cookie, see https://www.drupal.org/node/2678628 — but there are no security consequences there.

If that's the one that is triggering this alert, then the problem is clear: your security testing tool is making blanket statements that don't make sense.