Ensure 'Accept cookies' is set to 'From websites I visit' or 'From current website only'


This recommendation pertains to the automatic acceptance of third-party cookies.


Accepting cookies may allow the web servers to interact with other cookies already in place. For instance, the HEIST cookie exploit allows for retrieving data from cookies stored on a device. Cookies often follow poor coding practices and include authentication properties. Limiting acceptance of cookies to only those from sites intentionally visited reduces the likelihood of exploit.


Open Apple Configurator.

Open the Configuration Profile.

In the left windowpane, click on the Restrictions tab.

In the right windowpane, under the tab Apps, set the Accept cookies menu to From websites I visit or From current website only.

Deploy the Configuration Profile.

Additional Information:

From websites I visit accepts cookies from the current domain, and any domain you've visited. From current website only only accepts cookies from the current domain.

See Also