I have a cookie that is httponly but without the secure flag. Under this condition, can an attacker capture the cookie, although the site is only on HTTPS?
-
3The httponly flag tells the web browser that client scripts should not be able to read it, it doesn't mean the cookie will be "sent over http only."– userOct 14, 2019 at 14:53
-
Your site is 100% in HTTPS? Do you have strict transport security?– curiousguyOct 14, 2019 at 18:10
Add a comment
|
1 Answer
You should still set the secure flag, even if your site is only served over HTTPS. A single unencrypted HTTP call is all it takes to leak a cookie, and it can even be to an endpoint that doesn't exist or isn't served over plain HTTP. The only way to prevent all such calls is to use HSTS with preloading. And even then, setting the secure flag costs you nothing, so why not do it?
As for the HttpOnly flag, it is for protecting cookies in case of an XSS vulnerability. It is completely unrelated to the secure flag or any other issues related to HTTPS. It does not protect you against MITM attacks, which is what the secure flag is meant to protect you from.