I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.

  • 1
    Why is your site still running on HTTP only?
    – Jeroen
    Apr 16, 2019 at 13:54

2 Answers 2


From the documentation of Set-Cookie:

Secure Optional
A secure cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol. ....
Note: Insecure sites (http:) can't set cookies with the "secure" directive anymore (new in Chrome 52+ and Firefox 52+).

In other words: it makes no sense to set secure on plain HTTP at all since a cookie with such a settings would essentially be ignored.


The secure flag tells the browsers to only send a cookie if the request is being made over HTTPS. So, if your site only supports HTTP, but you still want the cookie(s) to be sent, then do not set the secure flag.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .