1

I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.

  • 1
    Why is your site still running on HTTP only? – Jeroen Apr 16 '19 at 13:54
4

From the documentation of Set-Cookie:

Secure Optional
A secure cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol. ....
Note: Insecure sites (http:) can't set cookies with the "secure" directive anymore (new in Chrome 52+ and Firefox 52+).

In other words: it makes no sense to set secure on plain HTTP at all since a cookie with such a settings would essentially be ignored.

3

The secure flag tells the browsers to only send a cookie if the request is being made over HTTPS. So, if your site only supports HTTP, but you still want the cookie(s) to be sent, then do not set the secure flag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.