Daniel Schaffer Daniel Schaffer - 1 year ago 54
HTTP Question

Reading cookies via HTTPS that were set using HTTP

Can cookies set using HTTP be read using HTTPS?

Answer Source

Cookies set with the "Secure" keyword will only be sent by the browser when connecting by a secure means (HTTPS). Apart from that there is no distinction - if "secure" is absent, the cookie may be sent over an insecure connection.

In other words, cookies that you want to protect the contents of should use the secure keyword and you should only send them from the server to the browser when the user connects via HTTPS.

  • HTTP: Cookie with "Secure" will be returned only on HTTPS connections (pointless to do this)
  • HTTPS: Cookie with "Secure" will be returned only on HTTPS connections
  • HTTP: Cookie without "Secure" will be returned on HTTP or HTTPS connections
  • HTTPS: Cookie without "Secure" will be returned on HTTP or HTTPS connections (could leak secure information)

Reference: RFC 2109 See 4.2.2 (page 4), 4.3.1

Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download