Here is a test case from a recent application security asessment which I have had experienced:

cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue));
cookie.setSecure(true); // for secure cookie by java

Although 'setSecure' is set to true, does this prevent attacks against attacks on the application via XSRF/CSRF/See-Surf or XSS/CSS or HTTPOnly has to be on HTTP headers!? or both?

  • did you look up to see what setSecure did?
    – schroeder
    Apr 3 '15 at 3:25
  • It was set by the coder commenting it out and describing it was implemented for java secure cookies. Apr 3 '15 at 6:01

HTTPOnly disallows the cookie from being read by JavaScript via document.coookie.

The Secure flag will restrict the cookie to HTTPS, but if your site has an XSS vulnerability, HTTPS will not protect you. The XSS URL https://example.com?q=<script>alert(document.cookie)</script> works just as well as http://example.com?q=<script>alert(document.cookie)</script>. Only the HTTPOnly flag will disallow script access to the cookie.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.