0

I was asked this question "If the cookie is marked secure and the web application is over http , Cannot we access the application ?"

Considering the secure flag is to ensure the cookie is sent only on encrypted network

Improve this question
1
  • 1
    How can the application even work if it uses a cookie with flag secure but does not use HTTPS? In case of plain HTTP no cookie will be sent and thus the application not work.
    – Steffen Ullrich
    Commented Oct 17, 2019 at 13:58

1 Answer 1

Reset to default
0

Secure-only means that the cookie won't be sent to a server using insecure (http) connection. So the application cannot rely on it from a server side.

Cookie could still be sued by client side code (ie: javascript) so long Http only is not set (probably a bad idea tho).

Note that according to https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Secure_and_HttpOnly_cookies

Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.

So your http application wouldn't even be able to set the cookie (browser won't save it, or maybe will save it but without the secure flag: in such case, the application might "still work" since it will receive the cookie on next http request)

Last, you could still "access" the application, but you will be seen as "anonymous" since no cookie will be sent.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .