I had a similar need, but slightly more complex. I needed all cookies coming from the servers to have both the secure and httponly flags set, but it was critical that the domain, path and expires options were kept. So I combined Chris Naccarato's script with the one listed on HowTo: Handle cookies in TrafficScript and my own thinking and came up with the following: #Force HttpOnly and Secure flags for all cookies, but keep domain, path and expires. $sc = http.getResponseHeader( "Set-Cookie" ); if ($sc != "") {   # Build an array of cookies set by the server   $cookies = [];   foreach( $line in string.split( $sc, "\r\nSet-Cookie:" ) ) {       $cookie = [];       $kvs = string.split( $line, ";" );       $a = string.trim( array.shift( $kvs ));       $cookie["name"]  = string.left($a,string.find($a,"="));       $cookie["value"] = string.right($a,string.len($a) - string.find($a,"=") - 1);       while ( array.length ( $kvs ) > 0 ) {         if ( string.regexmatch( string.trim( $kvs[0] ), "^path", "i" ) ) {             $a = string.split( array.shift ( $kvs ), "=");             $cookie["path"] = $a[1];         } else if ( string.regexmatch( string.trim( $kvs[0] ), "^domain", "i" ) ) {             $a = string.split( array.shift ( $kvs ), "=");             $cookie["domain"] = $a[1];         } else if ( string.regexmatch( string.trim( $kvs[0] ), "^expires", "i" ) ) {             $a = string.split( array.shift ( $kvs ), "=");             $cookie["expires"] = $a[1];         } else if ( string.regexmatch( string.trim( $kvs[0] ), "^secure", "i" ) ) {             $cookie["secure"] = array.shift ( $kvs );         } else if ( string.regexmatch( string.trim( $kvs[0] ), "^httponly", "i" ) ) {             $cookie["httponly"] = array.shift ( $kvs );         } else if ( string.trim( $kvs[0] ) == "" ) {             #ignore, blank cookie option             array.shift( $kvs );         } else {             log.info( "Unknown cookie option: ".array.shift( $kvs )." for new cookie ".$cookie["name"] );         }       }       array.push( $cookies, $cookie );   }   # Rebuild the cookies with the secure and HttpOnly flags before sending them to the browser   foreach( $cookie in $cookies ) {       $newcookieoptions = "";       if ( string.trim( $cookie["domain"] ) != "" ) {         $newcookieoptions = "domain=".$cookie["domain"]."; ";       }       if ( string.trim( $cookie["path"] ) != "" ) {         $newcookieoptions = $newcookieoptions."path=".$cookie["path"]."; ";       }       if ( string.trim( $cookie["expires"] ) != "" ) {         $newcookieoptions = $newcookieoptions."expires=".$cookie["expires"]."; ";       }       $newcookieoptions = $newcookieoptions." secure; HttpOnly";       http.setResponseCookie( $cookie["name"],$cookie["value"],$newcookieoptions );   } } ... View more