Domino cookies needs to be secure and have samesite

The first thing is that Domino authentication cookies needs to be secured so you can’t hijack the content. This can be performed using the httponly and secure attributes.

Secondly we might need a way to add the samesite attribute to the cookies if we get problems with the new settings in Chrome. The same site settings is to block third party cookies that is used for advertising but in Domino this could give you problems if your applications is bouncing between domains. How to achieve this.

Server setting, no the Domino server doesn’t have this setting.
Vote for the Same site ideas on Domino ideas

Javascript, no that isn’t an option because the settings added removes control from javascript.

But using XPages we have no problem reading and set the cookies again with the correct attributes.

I’ve added this to the after page load event, you need to add this code for all Domino Related cookies that your setup use. Like LTPAToken, SessionID or DomAuthSessId

var c:javax.servlet.http.Cookie = cookie.get("DomAuthSessId")
var response=facesContext.getExternalContext().getResponse();

response.addHeader("Set-Cookie","DomAuthSessId="+c.getValue()+"; Path=/; Secure; HttpOnly; SameSite=None");

This changes the cookies after you have done a login but it will not help if the cookies is removed when you do a login.

Leave a comment ?


  1. Fredrik, I have been asking for Samesite cookies for a long time. It is frustrating.

  2. Hi Fredrik
    Wich version of notes/domino have you tried? It’s useful in 9.x?


  3. Add this to the “I can’t believe it’s not in Domino” list. Like MFA/2FA.

  4. Fredrik,

    The only problem is this would not work for other design elements like agents and file resources. This has been requested for a long time and it is still not in Domino 11.0.1

  5. It works if you sends the user to an xpage and after that redirect to the file resource or agent.

  6. This only works after reloading the webpage. Is there a way to load it when the page loads the first time?

  7. If the xpage is the first thing loaded after the login, then cookies will be set directly without a reload

  8. Larry-ITS Yeboah

    Thanks for the reply. There’s no login page. It’s the first page to load.

Leave a Comment

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.