# Securing session cookies

> Mark the Cascade CMS session cookie secure and HttpOnly so it is only sent over TLS and is not readable from scripts.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/installation-and-upgrades/system-configuration/securing-session-cookies.html
category: Cascade Administration
article-type: how-to
content-kind: article
release-availability: all
tags: security, installation
updated: 2026-10-06

Follow the steps below to set the secure flag for Cascade CMS session cookies:

- Stop Cascade CMS
- Edit `tomcat/conf/web.xml`
- Locate `<session-config>` and place the following code within those tags:
    ```markup
    <cookie-config>
       <http-only>true</http-only>
       <secure>true</secure>
      </cookie-config>
    ```

- Save
- Start Cascade CMS