Secure and HttpOnly flag for load balancer cookie

Question

Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a session identifiers. Should I add this flags to all three cookies?

Answer 1

HttpOnly - Flag tells user-agent(browse) to use cookie only in communication and do not allow access of cookie programmatically in JavaScript.

Secure - Flag tells user-agent to send cookie in communication only if communication medium is secure (HTTPS not HTTP)

If your cookie used in any HTTP communication then you may need to disable Secure flag but its not recommended.

Answer 2

I'd assume you don't want to share at least BIGipServer and IDSESSION with malicious users, because first one probably leads to information disclosure and second - to session hijacking. If there is a probability of an XSS in your application then mentioned flags are definitely necessary.

Answer 3

It is recommended that you add those flags to those cookies and only remove them if you have a business need.

Secure: You should be using TLS, so this is a hard yes.

HttpOnly: Only if the browser needs to access the cookie from Javascript. Load-balancer cookies shouldn't be modified from the browser anyway.