When making an HTTP callout using HttpRequest, Set-Cookie headers returned with the HttpOnly flag are not included in the HttpResponse. This appears to be consistent with RFC 6265:

The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts).

Is there a way to make use of cookies set with the HttpOnly flag in subsequent HttpRequest objects? Support for an opaque cookie jar would be useful so that each time an HttpRequest is sent using Http.send, the cookies in the jar are sent, and the cookie jar is updated when Set-Cookie headers are included in the response. Something like:

CookieJar jar = new CookieJar();
Http callout = new Http();

This problem has recently broken our integration between Salesforce and GoodData. I don't know if HttpOnly support was added in Winter '14 or if GoodData just started setting the HttpOnly flag.

Here's some sample code to demonstrate the problem.

Any ideas on how to address this problem?

  • 1
    That sounds broken to me. Apex Code isn't a malicious JavaScript potentially injected into a page (the intent of 6265), it's a controlled scripting language in control of the user/developer.
    – sfdcfox
    Oct 26, 2013 at 2:02
  • I'm not sure the HttpOnly flag is a good idea even in a browser, but I agree; it seems bizarre to respect the flag in non-browser HTTP clients.
    – xn.
    Oct 26, 2013 at 2:50
  • I agree with 6265 in situations where not all content on the page is under your control. For example, sites like Facebook, if a JavaScript got loose it could hijack your session and do naughty stuff, but you still need to be logged in to Facebook to do anything.
    – sfdcfox
    Oct 26, 2013 at 3:02

1 Answer 1


This is now listed as a known issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .