Does SSL also encrypt cookies?

A review of SO doesn't categorically answer this question. It could be implied, but I would like to get it on the record specifically.

If SSL is active, it will encrypt HTTP header data, like "set-cookie" ? I know about "setSecure" to only transmit cookie's if HTTPS is active, but if SSL is active I would like to confirm if all header data is encrypted by default without the need to use "setSecure".

Solution 1:

Data sent over SSL (HTTPS) is fully encrypted, headers included (hence cookies), only the Host you are sending the request to is not encrypted. It also means that the GET request is encrypted (the rest of the URL).

Although an attacker could force a client to respond over HTTP, so it is highly recommended to use the "Secure" flag in your cookie, which enforce the use of HTTPS to send cookies.

Also, using the flag HTTPOnly would greatly enhance the security of your site since it does not allow Cookies to be read with Javascript code (Mitigating potential XSS vulnerabilities).

Solution 2:

SSL encrypts the entire HTTP session, including headers.

That is why they renamed it TLS for "Transport Layer Security". The "Transport Layer" sits below the "Application Layer" (among others) in the network stack.

So yes.