diff --git a/plugins/common/cookie/cookie.go b/plugins/common/cookie/cookie.go
index 9428ee2bc0ea2..68219dbf46437 100644
--- a/plugins/common/cookie/cookie.go
+++ b/plugins/common/cookie/cookie.go
@@ -20,7 +20,7 @@ type CookieAuthConfig struct {
 	URL    string `toml:"cookie_auth_url"`
 	Method string `toml:"cookie_auth_method"`
 
-	Headers map[string]string `toml:"cookie_auth_headers"`
+	Headers map[string]*config.Secret `toml:"cookie_auth_headers"`
 
 	// HTTP Basic Auth Credentials
 	Username string `toml:"cookie_auth_username"`
@@ -98,11 +98,19 @@ func (c *CookieAuthConfig) auth() error {
 	}
 
 	for k, v := range c.Headers {
+		secret, err := v.Get()
+		if err != nil {
+			return err
+		}
+
+		headerVal := secret.String()
 		if strings.EqualFold(k, "host") {
-			req.Host = v
+			req.Host = headerVal
 		} else {
-			req.Header.Add(k, v)
+			req.Header.Add(k, headerVal)
 		}
+
+		secret.Destroy()
 	}
 
 	resp, err := c.client.Do(req)