# Setting Response Header Set-Cookie: Secure;HttpOnly

**URL:** <https://community.traefik.io/t/setting-response-header-set-cookie-secure-httponly/2773>\
**Category:** Traefik v1\
**Tags:** docker\
**Created:** [November 4, 2019, 5:56pm UTC](https://community.traefik.io/t/setting-response-header-set-cookie-secure-httponly/2773 "2019-11-04T17:56:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![playermanny2](https://avatars.discourse-cdn.com/v4/letter/p/96bed5/32.png) [@playermanny2](https://community.traefik.io/u/playermanny2)\
**Post date:** [November 4, 2019, 5:56pm UTC](https://community.traefik.io/t/setting-response-header-set-cookie-secure-httponly/2773/1 "2019-11-04T17:56:17Z")

</div>

Hi,

What's the proper way to set Reponse Header Set-Cookie: Secure;HttpOnly. I want to force all cookies to utilize secure and httponly.

I'm using traefik version 1.7.19 and docker-compose labels to set headers.

I'm using

"traefik.frontend.headers.customResponseHeaders=Set-Cookie:Secure;HttpOnly" which works but it seems to replace any cookies being set by the application with a blank cookie name and the value to be "secure"

---

<div class="post-metadata">

**Author:** ![dev-404](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dev-404/32/2798_2.png) [@dev-404](https://community.traefik.io/u/dev-404)\
**Post date:** [August 16, 2020, 3:16am UTC](https://community.traefik.io/t/setting-response-header-set-cookie-secure-httponly/2773/2 "2020-08-16T03:16:13Z")

</div>

@playermanny2 did you fix this issue. If so, could you share the solution. I'm having the same issue and would like to understand on how to append "Secure;HttpOnly" flags to the existing cookies.

---

<div class="post-metadata">

**Author:** ![s4ber7](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/s4ber7/32/2746_2.png) [@s4ber7](https://community.traefik.io/u/s4ber7)\
**Post date:** [October 19, 2020, 1:54pm UTC](https://community.traefik.io/t/setting-response-header-set-cookie-secure-httponly/2773/3 "2020-10-19T13:54:18Z")

</div>

@playermanny2 Were you able to solve this issue?

---

<div class="post-metadata">

**Author:** ![dev-404](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dev-404/32/2798_2.png) [@dev-404](https://community.traefik.io/u/dev-404)\
**Post date:** [November 3, 2020, 12:31am UTC](https://community.traefik.io/t/setting-response-header-set-cookie-secure-httponly/2773/4 "2020-11-03T00:31:56Z")

</div>

Hey Guys, Here is the [ticket](https://github.com/traefik/traefik/issues/7182) that i raised.

TL;DR - There is an [open proposal](https://github.com/traefik/traefik/issues/6047) to implement this. Workaround would be to configure your backend application to add the secure flag or implementing your own plugin.