Delete secure cookie using javascript

Question

After reading some responses here and in other sites, I am a bit confused if a secure cookie (not httponly) can be deleted in client side using js.

for example, @8zero2-ops says that there is no relationship between secure flag and js involvement ( https://security.stackexchange.com/a/140330/209597 ). while in here

https://github.com/salemdar/ngx-cookie/issues/18#issuecomment-345261665

it is mentioned that js would not be able to read secure cookies.

Based on my own limited tests, I think js is not able to delete secure cookies. any information would be appreciated.

thanks

Answer 1

Secure cookies can be read with JavaScript, but HTTPOnly ones cannot. This means that if both flags are set, they cannot be read - the flags are terribly named.

Secure is to do with transmission - they should only be sent over HTTPS connections - but it is possible to set secure cookies from JS, and there isn't any specific expectation that they cannot be read by JS.

HTTPOnly is to do with client side access - they can't be viewed by JS, but can be sent over HTTP (and HTTPS - I have seen people claiming that they can only be sent over plain HTTP, which is not the case) connections for access by server-side scripts.

In many cases, both flags are set. In that case, the cookie will only be sent over HTTPS connections, and will be inaccessible by client side scripts.

What makes this more complicated is that cookies can have various parameters set, such as the domain and path attributes. If a cookie has the same name as a pre-existing cookie, but different values for any of these flags, a new cookie will be created. By the same token, if a cookie has a domain attribute set, attempting to delete it without including the domain attribute won't work - it deletes the non-existent cookie with the same name and no domain. Oh, and if you have the same domain and path for a secure cookie, and attempt to overwrite it without setting the secure flag, it doesn't create a new cookie, just removes the secure flag and sets the new value - this is a bit counterintuitive given the domain/path behaviour.

In order to delete a cookie from JS, therefore, you need to ensure that you are addressing the correct cookie by both name and flag values, and that it doesn't have HTTPOnly flag set, and that you're on a page with a HTTPS certificate. If any of these are not true, you won't be able to edit/delete it.

Answer 2

Nothing about the specification of the "Secure"-flag mentions anything about JavaScript.

The purpose of the "Secure" flag is to signal to the browser that cookies should not be sent to the server unless the connection is secure. This should prevent an attacker, who can eavesdrop on connections, from gaining access to potentially sensitive data - such as session identifiers.

JavaScript can still be used to read those cookies, and to delete them. The flag which would prevent that is called "HTTPOnly", which in turn would make those cookies invisible for JavaScript.

The fact that most guides suggest using both "Secure" and "HTTPOnly" for everything, leads people to believe that they have to be used together, or that they are synonymous.