All Questions
2 questions
34
votes
6
answers
35k
views
Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?
With reference to some security paper I read, I found out that a cookie with the secure flag set can only be sent by the client over connections that are using HTTPS, not HTTP, but the cookie itself ...
- 541
2
votes
0
answers
178
views
If I clear my browsing data, is HSTS protection removed?
I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
- 31