Hi!
I want to ask about secured cookies via HTTPS.
Should secured cookie be automatically encrypted or not?
Why do I can see value of secure cookie in the browser ?
Is secured cookie != encrypted cookie ?
Greetings!
Chris
Loading
Know the answer? Post it — somebody with the same question will find it here.
Sign in to answer this question
It is the same account you read, post and publish with — and you will come straight back to this page.
Krzysztof KrawiecPosted Aug 8, 2016, 5:51 AM
Vinay SinghPosted Aug 8, 2016, 5:06 AM
Data sent over SSL (HTTPS) is fully encrypted, headers included (hence cookies), only the Host you are sending the request to is not encrypted. It also means that the GET request is encrypted (the rest of the URL).
Although an attacker could force a client to respond over HTTP, so it is highly recommended to use the "Secure" flag in your cookie, which enforce the use of HTTPS to send cookies.
Also, using the flag HTTPOnly would greatly enhance the security of your site since it does not allow Cookies to be read with Javascript code (Mitigating potential XSS vulnerabilities).