20

If my website has HSTS and forced HTTPS (i.e. user won't be able to access the plain HTTP version of the website), is there any point in setting secure: true for the cookies?

1
  • Aside: Not all cookies need to be secure.
    – MrWhite
    Commented Mar 18, 2018 at 23:03

2 Answers 2

40

Yes, you should still mark your cookies as secure, for three reasons:

  • You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server with a different configuration?

  • HSTS is trust on first use. If your HSTS has expired but your cookies has not, the browser may send them unencrypted. Whether or not there is something responding to plain HTTP is irrelevant here.

  • As Tgr writes, not all browsers support HSTS.

I admit that the benefits aren't huge here, but the cost is basically zero. So set the secure flag!

14
  • 9
    @Avery235 Not sure I understand the issue. Postman can hit TLS-protected endpoints just fine. Could you elaborate?
    – user18519
    Commented Mar 18, 2018 at 12:16
  • 2
    @Avery235 Yeah, thats what the secure flag does - it instructs the client only to send the cookie over HTTPS connections.
    – Anders
    Commented Mar 18, 2018 at 17:19
  • 13
    @Avery235 there are just so many things wrong with your above replies
    – McMatty
    Commented Mar 19, 2018 at 1:39
  • 7
    @Avery235 Its very unclear why you would have to run your servers locally. As has been pointed out, Postman does handle TLS. And if you are telling the truth when you say that you have "forced HTTPS", it should not be possible to communicate over plain HTTP, secure cookie or not, right?
    – Anders
    Commented Mar 19, 2018 at 6:30
  • 6
    "using the production server when doing any development on the front-end..." - sorry, but I hope that was a joke, too.
    – sleske
    Commented Mar 19, 2018 at 9:34
14

Not all browsers honor HSTS. IE mobile doesn't, for example; desktop IE only does since version 11; cloud-based browsers like Opera Mini don't. Marking your cookies as secure is trivial and good defense in depth.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .