CODEWITHSUNDEEP
httpsslcookieshttpssession-cookies
Avery235
Avery235

Reputation: 5316

Secure: true on cookie for forced https

If my website has HSTS / forced https (i.e. user won't be able to access http version of the website), is there any point in setting secure: true for the cookies?

Upvotes: 2

Views: 6528

Answers (1)

Paul
Paul

Reputation: 141827

Absolutely, there is a point. Without secure: true a browser would send those cookies along with any non-encrypted HTTP requests to your domain whether or not your domain listens to request or responds to it.

You might not expect your user to workaround HSTS and make a non-HTTPS request once they've visited your website and received a cookie, but they might do it anyway for various reasons including, but not limited to, an attacker who is trying to hijack their session manipulating them into doing so.

Upvotes: 1

Related Questions