Reading cookies via HTTPS that were set using HTTP

http https cookies

Can cookies set using HTTP be read using HTTPS?


Cookies set with the "Secure" keyword will only be sent by the browser when connecting by a secure means (HTTPS). Apart from that there is no distinction - if "secure" is absent, the cookie may be sent over an insecure connection.

In other words, cookies that you want to protect the contents of should use the secure keyword and you should only send them from the server to the browser when the user connects via HTTPS.

  • HTTP: Cookie with "Secure" will be returned only on HTTPS connections (pointless to do, see note below)
  • HTTPS: Cookie with "Secure" will be returned only on HTTPS connections
  • HTTP: Cookie without "Secure" will be returned on HTTP or HTTPS connections
  • HTTPS: Cookie without "Secure" will be returned on HTTP or HTTPS connections (could leak secure information)

Reference: RFC 2109 See 4.2.2 (page 4), 4.3.1

Note: It is no longer possible to set "secure" cookies over insecure (e.g. HTTP) origins on Firefox and Chrome after they implemented the Strict Secure Cookies specification.

Related

Can I rebase a Git branch without modifying my working copy?
How to make tesseract to recognize only numbers, when they are mixed with letters?
stopping setup.py from installing as egg
What exactly are "containers" in python? (And what are all the python container types?)
Decomposing tuples in function arguments
How can I prevent the TypeError: list indices must be integers, not tuple when copying a python list to a numpy array?
How do I set up CLion to compile and run?
Cognito User Pool: How to refresh Access Token using Refresh Token
How to clear $Error in PowerShell?
Accessibility and all these JavaScript frameworks
"Conflicts prevent checkout" error using Git in Visual Studio
How to properly validate input values with React.JS?