Menu
Can a cookie be made in HTTPS, and used in HTTP if secure parameter of the cookie is set false? I have a website where I only require a single page to be in HTTPS, such as the login or maybe a special feature page.
I assume that the cookie will be (safe as it is transfered with SSL) although sent back as non-hashed when on a non-SSL page, is safe to assume so?
403
Cookies can't be shared between domains so the http and https pages would need to be on thesame domain as a minimum (which would mean having your own dedicated IP address and security certificate for your domain.
Using the HttpOnly tag when generating a cookie helps mitigate the risk of client-side scripts accessing the protected cookie, thus making these cookies more secure. If the HttpOnly flag is included in the HTTP response header, the cookie cannot be accessed through the client-side script.
Http, https and secure flag. When the HTTP protocol is used, the traffic is sent in plaintext. It allows the attacker to see/modify the traffic (man-in-the-middle attack). HTTPS is a secure version of HTTP — it uses SSL/TLS to protect the data of the application layer.
The secure attribute is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure attribute is to prevent cookies from being observed by unauthorized parties due to the transmission of the cookie in clear text.
In short: yes.
Setting a cookie on an SSL secured response, but leaving out the secure flag, will make the cookie behave no different than if it was transferred over a non-SSL connection.
197
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
