# How to enable the httpOnly attribute for current\_user Cookie

**URL:** <https://forum.ansible.com/t/how-to-enable-the-httponly-attribute-for-current-user-cookie/36068>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [December 3, 2021, 7:36pm UTC](https://forum.ansible.com/t/how-to-enable-the-httponly-attribute-for-current-user-cookie/36068 "2021-12-03T19:36:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![swathi\_t](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@swathi\_t](https://forum.ansible.com/u/swathi_t)\
**Post date:** [December 3, 2021, 7:36pm UTC](https://forum.ansible.com/t/how-to-enable-the-httponly-attribute-for-current-user-cookie/36068/1 "2021-12-03T19:36:22Z")

</div>

Hi,

I am using AWX 15.0.0.  
In our Pen testing we found the vulnerability: HTTPOnly and Secure attributes are not set for Cookies  
I was able to enable to Secure attribute by adding these changes in the “settings.py” file.

settings.py

CSRF\_COOKIE\_SECURE= True  
SESSION\_COOKIE\_SECURE= True