My understanding of secure flag on HTTP cookies is: it will prevent the client from sending cookie in an HTTP connection, preventing a MITM attacker from grabbing the cookie details.

What if a Web application is running only on HTTPS? Do I still need the secure flag on each HTTP cookie? If so, how would that increase security?

  • I rephrased much of the question trying to preserve intent; I changed "server sends HTTP cookie" to "client sends the HTTP cookie" as I believe that was a mind fart not an actual misunderstanding of the protocol. – curiousguy Dec 18 '17 at 5:26

As you already said, a man in the middle could grab the cookie while in http transit when the secure flag is not set.

Note that the secure flag tells the browser to not transmit the cookie when not on a secure connection. So the other way round than what you expected.

Now, even if your website is only running on https, a man in the middle might offer http only, proxying your web application, connecting to it via https.

This way, the cookie will be sent over http whenever a user without https everywhere manually enters the URL, unless you also have the HSTS set.

But even if you have, a man in the middle could remove the header for new visitors on their http service, stealing their cookie. This however is unfortunately true for the secure flag, as well.

So, in a scenario with a man in the middle, setting the secure flag will make it harder for the attacker to gain access to cookies of users, even if your service is only offering https.

  • 1
    The secure flag is like the https: URL scheme, but are meta information, both need to be used, both might be scrubbed by an attacker who intercepts the transmission if the initial connection is not secure. – curiousguy Dec 18 '17 at 5:28

What if a Web application is running only on HTTPS?

If the client exclusively connects to the server using HTTPS, the secure flag has no effect. Note that this is independent of what the server does.

If you have full control over the client, such as a phone app or desktop application, you can enforce HTTPS-only connections. In a browser you can enforce HTTPS requests using HSTS.

  • If your client is a web browser, then be aware that any (other) unprotected http site can be intercepted and changed to send a request to the insecure version. (Consider an insecure WiFi network.) HSTS or the secure cookie flag would in both cases protect the cookie though. – Lekensteyn Dec 18 '17 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.