Thank you anaidu! I'm running into the same problem. Is there a list of all Splunk cookies that can't be HttpOnly? Is it manageable to try and exclude these using "Header edit Set-Cookie ^((?!EXCLUDED-COOKIES).*)$ $1;HttpOnly;Secure..." in httpd.conf? Or do they change too often? ... View more