Contents
HttpOnly and secure flags can be used to make the cookies more secure. When a secure flag is used, then the cookie will only be sent over HTTPS, which is HTTP over SSL/TLS. When the HttpOnly flag is used, JavaScript will not be able to read the cookie in case of XSS exploitation.
According to the Microsoft Developer Network, HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).
What is a secure cookie flag?
The Secure flag is used to declare that the cookie may only be transmitted using a secure connection (SSL/HTTPS). If this cookie is set, the browser will never send the cookie if the connection is HTTP. This flag prevents cookie theft via man-in-the-middle attacks.
How do I know if my cookie is HttpOnly?
Press F12, go to the network tab, and then press Start Capturing. Back in IE then open the page you want to view. Back in the F12 window you show see all the individual HTTP requests, select the one that’s the page or asset you’re checking the cookies on and double click on it.
JavaScript can still be used to read those cookies, and to delete them. The flag which would prevent that is called “HTTPOnly”, which in turn would make those cookies invisible for JavaScript.
This article describes HttpOnly and secure flags that can enhance security of cookies. When the HTTP protocol is used, the traffic is sent in plaintext. It allows the attacker to see/modify the traffic (man-in-the-middle attack). HTTPS is a secure version of HTTP — it uses SSL/TLS to protect the data of the application layer.
What happens when a cookie is sent over HTTPS?
When a secure flag is used, then the cookie will only be sent over HTTPS, which is HTTP over SSL/TLS. When this is the case, the attacker eavesdropping on the communication channel from the browser to the server will not be able to read the cookie (HTTPS provides authentication, data integrity and confidentiality).
How are HTTP and HTTPS related to secure Flags?
HTTPS is a secure version of HTTP — it uses SSL/TLS to protect the data of the application layer. When HTTPS is used, the following properties are achieved: authentication, data integrity and confidentiality. How are HTTP and HTTPS related to a secure flag of the cookie? Let’s consider the case of an authentication cookie.
Is it possible to bypass the HttpOnly flag?
When the HttpOnly flag is used, JavaScript will not be able to read the cookie in case of XSS exploitation. We also looked at how the combination of HTTP TRACE method and XSS might be used to bypass HttpOnly flag — this combination is a cross-site tracing (XST) attack.