58

A review of SO doesn't categorically answer this question. It could be implied, but I would like to get it on the record specifically.

If SSL is active, it will encrypt HTTP header data, like "set-cookie" ? I know about "setSecure" to only transmit cookie's if HTTPS is active, but if SSL is active I would like to confirm if all header data is encrypted by default without the need to use "setSecure".

2 Answers 2

81

Data sent over SSL (HTTPS) is fully encrypted, headers included (hence cookies), only the Host you are sending the request to is not encrypted. It also means that the GET request is encrypted (the rest of the URL).

Although an attacker could force a client to respond over HTTP, so it is highly recommended to use the "Secure" flag in your cookie, which enforce the use of HTTPS to send cookies.

Also, using the flag HTTPOnly would greatly enhance the security of your site since it does not allow Cookies to be read with Javascript code (Mitigating potential XSS vulnerabilities).

2
  • You make some good points about protocol oriented attacks. Best to keep "setSecure(true)" to protect session information from protocol switching. +1
    – angryITguy
    Commented Jun 1, 2011 at 10:40
  • so what kind of encryption does that follow?
    – Jitin
    Commented Nov 3, 2020 at 14:38
15

SSL encrypts the entire HTTP session, including headers.

That is why they renamed it TLS for "Transport Layer Security". The "Transport Layer" sits below the "Application Layer" (among others) in the network stack.

So yes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.