Do FIM cookies support settings secure and httponly attributes ?
3 years ago
Originally Published: 2014-12-10
Article Number
000064978
Applies To
Product Description: RSA Federated Identity Manager (FIM)  4.2 Service Pack 1 
FIM 4.2.1
Issue
Customer on FIM 4.1 reported the FIM cookie had neither the Secure nor the HTTPOnly flags set. 
Resolution
In FIM 4.2 SP1 an environmental variable was added to append the secure  attribute to the cookie. 
 It is documented in the install guide.
set JVM_OPTIONS=”-Dfim.securecookie.flag=true”

As of this 4.2 SP1  release there is no feature to support setting the httponly attribute on the FIM cookies