diff --git a/templates/default-ssl b/templates/default-ssl index 1b42cf55..59d0852a 100644 --- a/templates/default-ssl +++ b/templates/default-ssl @@ -44,7 +44,8 @@ NameVirtualHost *:{{ 443 }} SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key_{{ endpoint }} {% if enforce_ssl %} Header set Strict-Transport-Security "max-age={{ hsts_max_age_seconds }}" - Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure + # NOTE(ajkavanagh) due to Bug 1853173 the cookie can't be secure at this time, so disabling until a fix is found. + # Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure {% endif %} Header set X-XSS-Protection "1; mode=block" Header set X-Content-Type-Options "nosniff"