liveBook · Manning

Secure cookie

As explained in Grokking Web Application Security

The Secure cookie attribute restricts a cookie to transmission over secure connections such as HTTPS.

A secure cookie is sent only over HTTPS. Without the Secure attribute, a browser may attach a session cookie to an initial HTTP request before redirecting to HTTPS, allowing someone on the network to steal it. section 2.12 section 9.6

Protect a session cookie

Add Secure when the server sends the cookie: Set-Cookie: session_id=4b44bd3f-5186; Secure; HttpOnly. Secure blocks unencrypted transmission; HttpOnly separately blocks browser JavaScript from reading the value. section 9.6 section 2.13

Use Secure for cookies containing session identifiers and serve application traffic over HTTPS. Session-management tools commonly expose this behavior as a configuration flag. section 9.11 section 9.6

HTTP/2.0 200 OK
Content-Type: text/html
Set-Cookie: session_id=9264be3c7df125; Secure     #1

Inspect a minimal Set-Cookie response showing the Secure attribute. section 2.12

How Grokking Web Application Security covers it

How deep it goes
Explains HTTPS-only cookie transmission, redirect risk, and configuration use, but does not descend into browser implementation internals.
Examples
Uses Set-Cookie headers containing Secure, including a session cookie paired with HttpOnly.
What it assumes
Assumes basic familiarity with cookies and HTTP versus HTTPS while distinguishing Secure from HttpOnly.
What you can do after
Operate/configure session management to set Secure on session cookies and require HTTPS for application traffic.
How it connects
Connects Secure cookies with HTTPS, HTTP, session cookies, HttpOnly, session hijacking, and man-in-the-middle attacks.
Cover of Grokking Web Application Security
liveBookmanning.com
Read Grokking Web Application Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Grokking Web Application Security. The section links point to the parts of the book it draws on.