Configuring security attributes for XPages session cookies

Configure the required attributes for the XPages session ID cookie, depending on your environment.

Before you begin: In the Domino data directory, in the Properties folder, create a file named xsp.properties. You can use the sample file in the Properties folder (xsp.properties.sample) as your starting point.

Note: If the Properties folder already contains a file named xsp.properties, skip to the steps that follow.

Configuring the "secure" attribute for an Xpage SessionID cookie

When the server hosting an XPages application is configured to accept only https requests and the "SSL protected communication" option is enabled in Domino Administrator, you need to set the "secure" attribute for the session ID cookie manually.

  • Add the following line in the xsp.properties file:

    xsp.sessionid.cookie.secure=true

    CAUTION: You should enable this setting only if the server is configured to accept https requests exclusively. If both https and http requests are accepted, the server will not be secure and users could experience data loss.

Configuring the SameSite attribute for an Xpage Session ID cookie

Use of the SameSite cookie attribute reduces the risk of cross-site request forgery (CSRF). Configure this setting for XPages as follows:

  • Add the following line in the xsp.properties file:
    xsp.sessionid.cookie.samesite=value according to those in the following table:
    Value SameSite attribute
    0 Disabled (default)
    1 Strict
    2 Lax
    3 None

    where a value of 3 (None) causes the secure attribute to be set if isn't already set in the xsp.properties file.