Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
Of course it is possible...
Think about it this way:
Now, if you remove that first step, the cookie obviously can be sent in an HTTP request...
There are many forms of attack (e.g. DNS spoofing) that would cause you to connect with the wrong server, and of course HTTPS (using TLS/SSL) mitigates that quite well.
But let's not stop there, there is an even more trivial scenario.
You say that your web server only allows HTTPS.
If an attacker - or even just a careless programmer - can cause just a single request to be sent from the user's browser over HTTP, then that cookie WILL be sent. Over HTTP. In the clear. With no encryption. (I have actually seen this quite a bit in the wild, the 2nd type more than the 1st...)
Often, that is all that is needed.
Do yourself (and your users) a favor, always enforce HTTPS at all levels.
The core point is that though the server only accepts HTTPS, the client does not know it. The human user might, but not the software client.
Suppose the following setup:
Then the attacker just has to include in the Web forum the following HTML excerpt:
Just that. When your browser sees that, it will open a TCP connection to
Then your browser sends an HTTP GET request over the connection. That request will include the cookie, in plain view, since the target is
(Variants of the attacks include a more active attacker with, e.g., DNS spoofing to impersonate a fake