0
  1. Is it possible to steal cookies through MITM on 'HTTPS' site if the cookies are missing 'Secure' Flag?

  2. Is it possible to steal cookies through MITM on 'HTTP' site if the cookies have 'Secure' Flag?

2

Is it possible to steal cookies through MITM on 'HTTPS' site if the cookies are missing 'Secure' Flag?

If the client does a HTTP request, the browser sends the cookies over plaintext HTTP to the server, and the attacker can read the cookie. A man-in-the-middle attacker typically can cause a HTTP request by modifying any HTTP page. For example, if you browse to any HTTP site he can add <img src="http://yourbank.com/"> which will cause a plaintext request to yourbank.com, with the cookies.

Strict Transport Security (HSTS) protects against this, because it forces the connection to be over HTTPS.

Is it possible to steal cookies through MITM on 'HTTP' site if the cookies have 'Secure' Flag?

No, because the cookies are not sent over plaintext HTTP if they have the secure flag. However, it may still be possible to set cookies. Overwriting existing secure cookies is no longer possible, but creating a new cookie is still possible. Cookie prefixes prevent this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.