70

Can cookies set using HTTP be read using HTTPS?

1 Answer 1

109

Cookies set with the "Secure" keyword will only be sent by the browser when connecting by a secure means (HTTPS). Apart from that there is no distinction - if "secure" is absent, the cookie may be sent over an insecure connection.

In other words, cookies that you want to protect the contents of should use the secure keyword and you should only send them from the server to the browser when the user connects via HTTPS.

  • HTTP: Cookie with "Secure" will be returned only on HTTPS connections (pointless to do, see note below)
  • HTTPS: Cookie with "Secure" will be returned only on HTTPS connections
  • HTTP: Cookie without "Secure" will be returned on HTTP or HTTPS connections
  • HTTPS: Cookie without "Secure" will be returned on HTTP or HTTPS connections (could leak secure information)

Reference: RFC 2109 See 4.2.2 (page 4), 4.3.1

Note: It is no longer possible to set "secure" cookies over insecure (e.g. HTTP) origins on Firefox and Chrome after they implemented the Strict Secure Cookies specification.

4
  • Good info... is there a spec or other reference somewhere that has this information? Commented Jan 29, 2010 at 18:08
  • 1
    Good ol' RFC2109 w3.org/Protocols/rfc2109/rfc2109 Note that "HTTPS" is not mentioned, that is left unspecified there.
    – richq
    Commented Jan 29, 2010 at 18:16
  • @richq HTTPS Cookie; you mean normal HTTP cookie with "secure" flag or cookie that is created in HTTPS connection?
    – webblover
    Commented Feb 7, 2017 at 12:39
  • @webblover hopefully the edit clears it up. I mean HTTP or HTTPS connections, then the cookie set with/without secure.
    – richq
    Commented Feb 7, 2017 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.