CODEWITHSUNDEEP
cookies
Jon Cram
Jon Cram

Reputation: 17309

Should non-secure cookies be sent over HTTPS?

I'm writing code to determine if a given cookie should be set on requests for a given URL and am currently considering the secure attribute.

I understand that a cookie marked as secure must be sent over HTTPS and must not be sent over HTTP.

I'm not clear on whether a cookie that is not explicitly marked as secure can be sent over HTTPS.

Should cookies not marked as secure be sent over HTTPS?

Or, in other words, can you complete the following table?

Secure attribute value | Request URL scheme | Allow cookie to be set?
=====================================================================
 true                  | HTTPS              | Yes
 true                  | HTTP               | No
 false (or not set)    | HTTPS              | ?
 false (or not set)    | HTTP               | Yes

Upvotes: 1

Views: 1174

Answers (1)

Slicedpan
Slicedpan

Reputation: 5015

Non-secure cookies can be sent over HTTPS. The secure flag is simply a way of instructing browsers to not send them across HTTP. They do not have to honour this, although I think all major browsers do.

They will happily send a non-secure cookie across HTTP though.

Upvotes: 1

Related Questions