Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a session identifiers. Should I add this flags to all three cookies?

  • It depends on what the cookies are for. I understand what IDSESSION is, but what about the two others? – Anders Nov 6 '18 at 14:42

I'd assume you don't want to share at least BIGipServer and IDSESSION with malicious users, because first one probably leads to information disclosure and second - to session hijacking. If there is a probability of an XSS in your application then mentioned flags are definitely necessary.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.