Oracle EBS security

HI

Application : 12.1.3

Database : 12.1.0.2.0

1 # Currently we have a security issues EBS iRecruitment external portal ....How do we apply a secure and HttpOnly attributte to the web cookies, is it config changes to the middle Tier.

Cookies downloaded from the Vacancies web portal are not securely configured which may lead to unauthorized access.

2 # The HTTP headers are not adequately configured which may expose users to phishing attacks.

On the application config we need to include the following in the respone header: in which config file do we add the below missing headers 

X-Frame-Options

X-Content-Type-Options

X-XSS-Protection

3 # The Vacancies web portal does not enforce the use of secure connections, which may allow an attacker to eavesdrop the traffic to obtain unauthorized access or tamper with information being transmitted.