Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be marked with a "secure flag", but I don't know how that flag look like.

How can I check that my cookies are only sent over encrypted https and not over unencrypted http, on my site that is only using https?

share|improve this question

2 Answers 2

up vote 22 down vote accepted

The cookies secure flag looks like this:

secure;

That's it.
This should appear at the end of the Http header:

Set-Cookie: mycookie=somevalue; path=/securesite/; Expires=12/12/2010; secure; httpOnly;

Of course, to check it, simply plug in any proxy or sniffer (I use the excellent Fiddler) and watch...

*Bonus: I also threw in there the httpOnly attribute, protects against cookie access from Javascript space, e.g. via XSS.

share|improve this answer

You can check using a tool like Firebug (an extension for Firefox: http://getfirebug.com/). The cookie will display as 'secure'.

Also if you're in Firefox you can look in the 'Remove Individual Cookies' window to be certain.

From a development point of view, a 'secure' cookie is the same as a regular one, but has an extra parameter in it. e.g.

SessionId=blah; path=/; secure; HttpOnly

Your development framework with hopefully support adding this easily - let us know what platform you're using if you need help.

While you're there, I'd suggest adding the HttpOnly flag as well if you're not manipulating cookies in Javascript, it will give the cookies additional protection from some XSS attacks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.