Contents
Overview. The secure attribute is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure attribute is to prevent cookies from being observed by unauthorized parties due to the transmission of the cookie in clear text.
If hackers can access your computer or your network, they can probably steal your cookies. As a result, criminals are having to resort to more advanced techniques, like stealing information passing through public WiFi networks. All a hacker needs to hack your cookies is a Firefox extension called Firesheep.
Can a cookie be set with the Secure attribute?
A cookie with the Secure attribute is sent to the server only with an encrypted request over the HTTPS protocol, never with unsecured HTTP (except on localhost), and therefore can’t easily be accessed by a man-in-the-middle attacker. Insecure sites (with http: in the URL) can’t set cookies with the Secure attribute.
To overcome the issue, we can use HTTPS when issuing the cookie and add the Secure flag to it: this instruct browsers to never send this cookie in plain HTTP requests.
Internet Security – Cookies. Cookies are files, generally from the visited webpages, which are stored on a user’s computer. They hold a small amount of data, specific to a particular client and website, and can be accessed either by the web server or the client computer which can be usernames, password, session token,…
How are cookies used in a web browser?
HTTP cookies were born to standardize this sort of mechanism across browsers: they’re nothing more than a way to store data sent by the server and send it along with future requests. The server sends a cookie, which contains small bits of data, the browsers stores it and sends it along with future requests to the same server.