Here is a test case from a recent application security asessment which I have had experienced:

cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue));
cookie.setSecure(true); // for secure cookie by java

Although 'setSecure' is set to true, does this prevent attacks against attacks on the application via XSRF/CSRF/See-Surf or XSS/CSS or HTTPOnly has to be on HTTP headers!? or both?

  • did you look up to see what setSecure did?
    – schroeder
    Apr 3, 2015 at 3:25
  • It was set by the coder commenting it out and describing it was implemented for java secure cookies. Apr 3, 2015 at 6:01

1 Answer 1


HTTPOnly disallows the cookie from being read by JavaScript via document.coookie.

The Secure flag will restrict the cookie to HTTPS, but if your site has an XSS vulnerability, HTTPS will not protect you. The XSS URL https://example.com?q=<script>alert(document.cookie)</script> works just as well as http://example.com?q=<script>alert(document.cookie)</script>. Only the HTTPOnly flag will disallow script access to the cookie.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .