The Secure cookie flag is an attribute that instructs the browser to include a cookie in requests only when the connection uses HTTPS. Over plain HTTP the cookie is withheld.
Why it matters
On an unencrypted connection, anyone on the network path can read the cookie in transit. A session cookie captured this way can allow an attacker to take over the account. With the Secure flag, the cookie never travels in clear text. Browsers also generally refuse to accept a Secure cookie that is set over an insecure connection.
Example
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=LaxVisiting http://example.com does not send session, while https://example.com does. Combined with HSTS, the browser avoids the plain HTTP request entirely.
Common mistakes
- Setting the flag on the session cookie but forgetting others, such as remember-me or preference cookies that contain identifiers.
- Serving part of the site over HTTP, so cookies are not sent where users expect.
- Testing on a local development server without HTTPS and leaving the flag disabled in production.
- Assuming it protects against script access; that is HttpOnly's job.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.