SAP Knowledge Base Article - Preview

2161064 - Cookie Security: HTTPOnly not Set in SMP 2.3 - SMP 3.0


We have performed an HP Fortify security scan of our ODP apps, and the scan raised the issue for cookies not having the HTTPOnly property set. 

  1. Can the HTTPOnly property be set for SMP cookies?
  2. Should this property be set to increase security?



  • Windows 2008R2
  • SAP Mobile Platform (SMP) 2.3.x, 3.0.x
  • Online Data Proxy (ODP) application


SAP Mobile Platform 2.3 ; SAP Mobile Platform 3.0


KBA , cross-site-scripting , xss , x-sup-sessid , kapsel , saml , cookie , javascript , maf , registration , MOB-SDK , SAP Mobile SDK , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.