Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a session identifiers. Should I add this flags to all three cookies?

  • It depends on what the cookies are for. I understand what IDSESSION is, but what about the two others? – Anders Nov 6 '18 at 14:42

I'd assume you don't want to share at least BIGipServer and IDSESSION with malicious users, because first one probably leads to information disclosure and second - to session hijacking. If there is a probability of an XSS in your application then mentioned flags are definitely necessary.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.