Contents
If the session cookie doesn’t have the secure attribute enabled, it is not encrypted between the client and the server, and this means the cookie is exposed to Unsecured Session Cookie hacking and abuse. Session cookies are used to perform session management for web applications.
Encrypted Cookies Server-side encryption adds more protection because the client can’t sniff the cookies. It is possible to use the encrypted value as the key to lookup data on the server. This means there is no need to take the cookie value and assume it is valid on the server.
Why is it important to secure cookies and sessions?
Securing cookies and sessions is vital to keeping an application secure. Many tutorials have been written on the subject, but as the internet (and browsers loading it) evolve so do the methods you can use to keep your application secure. In this article we’re going to break down the various components of a cookie and what they mean for security.
How are HttpOnly and secure Flags enhance security of cookies?
This article describes HttpOnly and secure flags that can enhance security of cookies. When the HTTP protocol is used, the traffic is sent in plaintext. It allows the attacker to see/modify the traffic (man-in-the-middle attack). HTTPS is a secure version of HTTP — it uses SSL/TLS to protect the data of the application layer.
The first step towards securing your cookie is to restrict that cookie to only your application. This is especially important in environments that support multiple sites or applications (the type of shared hosting you often see on corporate or university domains).
As a client-side defense mechanism it relies on browser support to work, but is only supported by a few browsers (Firefox 3+ and IE 7+, with partial support from Opera 9.5, IE6 and Chrome). In PHP, setting the arguments for cookies is done through some optional arguments on the “setcookie” function: