1

Newbie here.

I am aware that the Secure flag for cookies can be set either in Webserver configuration or in the application. What would be the best approach? Fix them in the code, or fix them in the Webserver? Or fix them at both the places? A lot of times, I have seen IT teams fixing this vulnerability only on the webserver configuration, leaving the application code untouched. Any downside in setting the cookie only in the Webserver and not in the application?

Improve this question

1 Answer 1

Reset to default
1

Using the webserver makes sure you don't forget any cookies. Using the application makes sure you can make a cookie without the flags, which may be important especially for httpOnly.

I recommend using both, so that if you need, you can disable the server one and just use the one in application for cookies that need the flag and also create cookies without it. It would be undesirable to have to go trough the code in retrospect looking for all the places cookies are used.

Of course, you may be able to create an exception in the server config as well, but better safe then sorry. Using both is the best option IMO, as there is no reason not to.

Improve this answer
1
  • 3
    Nice answer. It's good to have it in the application as well, because you never know if the app will be moved to another server with a different configuration. I think the goal should be that the app is secure in of itself, with as little dependencies to the external environment as possible.
    – Anders
    Commented Apr 25, 2018 at 11:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .