I have two related questions:

  1. As HttpOnly attribute is understood by a set of modern browsers, I was wondering if there is a list of all browsers which support the secure flag of the cookie?

  2. What would happend if a browser does not support the secure flag but an application sets it on the cookie?

  • 3
    did you find a mainstream browser which does not support secure flag? – Sachin Kumar Mar 27 '12 at 14:07
  • @SachinKumar: Good to see you here :) I am not sure about the browser versions which don't support secure flag. Actually I was just wondering if there are people using old browser versions, setting secure attribute will work for them or not and to test this I would at least need such specific versions which don't support cookie's secure flag :( – p_upadhyay Mar 27 '12 at 14:17
  • 2
    people on such old browsers versions have a lot of others things to worry about. You setting secure flag on their session cookies will not really help them a lot, they are the daredevils and don't care about being compromised ;) – Sachin Kumar Mar 27 '12 at 14:24
  • yep yep :) I have a meeting with such daredevils ;) will use your last comment as my initial speech :P – p_upadhyay Mar 27 '12 at 14:59
  • 2
    ;Secure is supported by all common browsers since 1997 (!); probably earlier. – Hendrik Brummermann Mar 27 '12 at 15:14

I've not seen a formal list of browsers which support secure but definitely in my experience all the recent iterations of popular browsers do.

My guess for what would happen if you found a browser that didn't support the flag, in the event that it was passed, is that it would just ignore the flag, although I suppose it would also be possible that it would ignore the whole cookie.

If you wanted to test it, one option might be to try setting a junk flag on a cookie (say with a random name) and see how browsers react to it.

Overall I'd say it's unlikely to be a problem unless your application is supporting very old or obscure browsers.

  • 1
    Indeed, any browser that is compliant with the RFC will support the secure attribute (and, for that matter, the httpOnly attribute too). Only old versions would be relevant for this, and those are not secure anyway... – AviD Mar 27 '12 at 13:19

What do you call a browser that doesn't support the secure flag? Broken!

Fortunately, every browser you're ever likely to use should support it. The secure flag has been part of the spec from since the earliest days of the Internet, and should be essentially universally supported. If you find a browser that doesn't support it, you get a cookie :-), that's a bug.

In short: Don't bother spending your time worrying about the possibility of a browser that doesn't support the secure flag. There are better things to worry about.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.