3 ms·
Not quite seeing the problem when you can use the secure flag to enable it on only https http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly http://en.
by kenton 13y ago
Not quite seeing the problem when you can use the secure flag to enable it on only https http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly
- amitamb 13y agoI haven't tested it fully but what if https is running on different port i.e. 443 (It is possible.) I believe marking cookie secure will only save you from MITM attack, not from attacks where ports are shared in a domain. i.e. cookies will be sent over https only but to a compromised port.
- homakov 13y agoFurthermore they will be sent to https but where set on http hacked page. Most of website don't implement protection from forcing