Secure Cookie Flag

The Secure cookie flag is an attribute that instructs the browser to include a cookie in requests only when the connection uses HTTPS. Over plain HTTP the cookie is withheld.

Why it matters

On an unencrypted connection, anyone on the network path can read the cookie in transit. A session cookie captured this way can allow an attacker to take over the account. With the Secure flag, the cookie never travels in clear text. Browsers also generally refuse to accept a Secure cookie that is set over an insecure connection.

Example

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax

Visiting http://example.com does not send session, while https://example.com does. Combined with HSTS, the browser avoids the plain HTTP request entirely.

Common mistakes

• Setting the flag on the session cookie but forgetting others, such as remember-me or preference cookies that contain identifiers.
• Serving part of the site over HTTP, so cookies are not sent where users expect.
• Testing on a local development server without HTTPS and leaving the flag disabled in production.
• Assuming it protects against script access; that is HttpOnly's job.

Related

• HttpOnly cookie
• HSTS
• HTTPS
• Cookie
• टूल: Cookie checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.