I have Netscaler AAA Setup using RFWEBUI portal theme. Our security scan shows that the https://aaa.domain.com/logon/logonpoint/index.html doesn't have HTTPOnly and Secure in the set-cookie in the response headers.

[Charlie Ting]

In Global Settings->Change authentication AAA settings, I have HTTPOnly Cookie Enabled, but still it's still not set in the Cookie. Any idea how to insert HTTPOnly and Secure?

[Hemang Raval]

Please refer below link for details:

https://docs.netscaler.com/en-us/citrix-adc/current-release/aaa-tm/aaa-rewrite.html