20

If my website has HSTS and forced HTTPS (i.e. user won't be able to access the plain HTTP version of the website), is there any point in setting secure: true for the cookies?

  • Aside: Not all cookies need to be secure. – MrWhite Mar 18 '18 at 23:03
40

Yes, you should still mark your cookies as secure, for three reasons:

  • You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server with a different configuration?

  • HSTS is trust on first use. If your HSTS has expired but your cookies has not, the browser may send them unencrypted. Whether or not there is something responding to plain HTTP is irrelevant here.

  • As Tgr writes, not all browsers support HSTS.

I admit that the benefits aren't huge here, but the cost is basically zero. So set the secure flag!

  • 9
    @Avery235 Not sure I understand the issue. Postman can hit TLS-protected endpoints just fine. Could you elaborate? – user18519 Mar 18 '18 at 12:16
  • 2
    @Avery235 Yeah, thats what the secure flag does - it instructs the client only to send the cookie over HTTPS connections. – Anders Mar 18 '18 at 17:19
  • 13
    @Avery235 there are just so many things wrong with your above replies – McMatty Mar 19 '18 at 1:39
  • 7
    @Avery235 Its very unclear why you would have to run your servers locally. As has been pointed out, Postman does handle TLS. And if you are telling the truth when you say that you have "forced HTTPS", it should not be possible to communicate over plain HTTP, secure cookie or not, right? – Anders Mar 19 '18 at 6:30
  • 6
    "using the production server when doing any development on the front-end..." - sorry, but I hope that was a joke, too. – sleske Mar 19 '18 at 9:34
14

Not all browsers honor HSTS. IE mobile doesn't, for example; desktop IE only does since version 11; cloud-based browsers like Opera Mini don't. Marking your cookies as secure is trivial and good defense in depth.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.