I have a load balancer that terminates https requests to http and therefore my backend servers see them as http. As a result, all of my cookies are set without a secure flag when you view cookies on the https version of this site. Does this matter anyway since we mix http and https? Amazon.com and several other large e-commerce sites seem to have non-secure cookies on https too.
A cookie has the "secure" flag if it says so. Theoretically, nothing prevents a "secure" cookie from being served by a HTTP (non-HTTPS) server; but your server software may take issue, since, from its point of view, the protocol is HTTP and a secure cookie makes little sense if it transits over HTTP. Your server does not know that it is behind a HTTPS-to-HTTP gateway. On the other hand, the client sees a HTTPS connection, and obtaining a secure cookie through such a connection will not surprise it at all.
The trouble with a non-secure cookie is that the client will happily send it to any server which just looks like the originating server. In the presence of an active attacker, you must assume that any non-secure cookie could be hijacked by the attacker. Depending on your exact situation, this may be a major, minor or inexistent threat.
1One could alter ones' cookies at the proxy boundary.– Jeff Ferland ♦Mar 15, 2011 at 19:33
The ;secure flag of session cookies is important, because the cookie is sent over http otherwise. An attacker may be able to trick the victim into opening an http connection even if you point all links and resources to https.
Normally it works to set the ;secure flag on the application server. The loadbalancer will just sent the answer back inside the https connection and everything is fine for the client. The main issue is to tell the load balancer to include the cookie in its http connection to the application server. It depends on the concrete implementation of the load balancer whether it does so automatically, or needs some configuration.
Yes, it matters. If the secure flag is not set on those cookies, you are vulnerable to Firesheep-like attacks, which is bad and could negatively impact users (e.g., especially users who are connecting over an open wireless connection). Therefore, I recommend that you ensure the secure flag is set on those cookies.
A secure cookie is only used when a browser is visiting a server via HTTPS, that will make sure that cookie is always encrypted when transmitting from client to server, and therefore less likely to be exposed to cookie theft via eavesdropping.
So the answer really is are you concerned about the content of those cookies being sent over http or is the data sensitive and should always be sent over https.
Well if i'm reading correctly you are asking if the HTTP cookies are compatible with HTTPS requests? It does matter but HTTP cookies and HTTPS cookies point to the same directory or host. So when you look at the set cookie code
GET /index.html HTTP/1.1 Host: www.example.org
I'd try specifying a http:// version and https:// version
1There is an optional flag in cookies which tells the browser to only sent it over a https and not over a http connection. This flag is important because an attacker may be able to trick the victim into following an http request to the target site, so he can sniff the session cookie. Mar 14, 2011 at 23:52