Thanks for the response.

Yes, i understand that. But here they dont create a secure or httponly cookie in the backend (webseal/ibm portal).

Earlier we were using ibm http server (IHS) and were adding these flags in the web server itself.

Now we are trying to replace IHS with nginx but not able to accomplish the same here.