Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I have two questions related to the same:

1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was wondering if we have a list of all browsers which support 'secure' flag of the cookie.

2 - If a browser does not support 'secure' flag but application sets a secure flag on the cookie, in that case what would happen?

share|improve this question
2  
did you find a mainstream browser which does not support secure flag? – Sachin Kumar Mar 27 '12 at 14:07
@SachinKumar: Good to see you here :) I am not sure about the browser versions which don't support secure flag. Actually I was just wondering if there are people using old browser versions, setting secure attribute will work for them or not and to test this I would at least need such specific versions which don't support cookie's secure flag :( – p_upadhyay Mar 27 '12 at 14:17
2  
people on such old browsers versions have a lot of others things to worry about. You setting secure flag on their session cookies will not really help them a lot, they are the daredevils and don't care about being compromised ;) – Sachin Kumar Mar 27 '12 at 14:24
yep yep :) I have a meeting with such daredevils ;) will use your last comment as my initial speech :P – p_upadhyay Mar 27 '12 at 14:59
2  
;Secure is supported by all common browsers since 1997 (!); probably earlier. – Hendrik Brummermann♦ Mar 27 '12 at 15:14

2 Answers

up vote 3 down vote accepted

I've not seen a formal list of browsers which support secure but definitely in my experience all the recent iterations of popular browsers do.

My guess for what would happen if you found a browser that didn't support the flag, in the event that it was passed, is that it would just ignore the flag, although I suppose it would also be possible that it would ignore the whole cookie.

If you wanted to test it, one option might be to try setting a junk flag on a cookie (say with a random name) and see how browsers react to it.

Overall I'd say it's unlikely to be a problem unless your application is supporting very old or obscure browsers.

share|improve this answer
1  
Indeed, any browser that is compliant with the RFC will support the secure attribute (and, for that matter, the httpOnly attribute too). Only old versions would be relevant for this, and those are not secure anyway... – AviD♦ Mar 27 '12 at 13:19
@AviD: Well said! Thanks for the reply. – p_upadhyay Mar 27 '12 at 15:03
up vote 3 down vote

What do you call a browser that doesn't support the secure flag? Broken!

Fortunately, every browser you're ever likely to use should support it. The secure flag has been part of the spec from since the earliest days of the Internet, and should be essentially universally supported. If you find a browser that doesn't support it, you get a cookie :-), that's a bug.

In short: Don't bother spending your time worrying about the possibility of a browser that doesn't support the secure flag. There are better things to worry about.

share|improve this answer
Thanks D.W. Obviously 'broken' should be the name.. – p_upadhyay Mar 28 '12 at 11:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.