Firstly, my website can't be accessed without a session established. After a session is established then the server would set cookies. However, if i assess the website without a session, my site will display a logout page. In this case, does the server need to set HttpOnly or the Secure flag in the response?



You should always set the cookie as HTTPOnly if your cookie contains sensitive information (such as personal info, session related info, session identifier etc.). This prevents JavaScript from accessing this cookie in case of an XSS bug in your website.

As far as Secure flag is concerned, you should set your SECURE cookie attribute if your clients communicate to the server over HTTPS. This prevents the client from sending your cookie over non-HTTPS communication.

| improve this answer | |
  • 1
    Try to avoid storing sensitive information in cookies, other than a session ID. – Jeroen Apr 23 '15 at 6:45
  • hi, thanks. However like I mentioned in my post, no one can access to the site without login in. Hence if anyone tries to go direct to the url without login in, then a logout/error page will be shown. In the response for this logout/error page, should the web server respond with HttpOnly/Secure flag as well? There is no session established since there is no login (direct url) and so no cookie would be set? – Pang Ser Lark Apr 23 '15 at 8:37
  • If no cookie would be set, where would you set the HTTPOnly and Secure flag? Those are properties of a cookie and not of a page. – NeverStopLearning Apr 24 '15 at 0:02
  • Maybe I rephrase my question. If a user enters the URL directly, it will be directed to a logout/error page. This is because the user did not log in, hence no session is establish. Should this logout/error page return cookie with HttpOnly/Secure flag? thanks – Pang Ser Lark Apr 24 '15 at 0:07
  • That depends. You can set a cookie depending on the functionality you need. For example, you can set a tracking cookie to track if the same user/device is trying to log in using a different account. But if that cookie does not contain anything sensitive, there is no need to mark it as Secure or HTTPOnly. – NeverStopLearning Apr 24 '15 at 0:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.