Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
A review of SO doesn’t categorically answer this question. It could be implied, but I would like to get it on the record specifically.
If SSL is active, it will encrypt HTTP header data, like “set-cookie” ? I know about “setSecure” to only transmit cookie’s if HTTPS is active, but if SSL is active I would like to confirm if all header data is encrypted by default without the need to use “setSecure”.
Data sent over SSL (HTTPS) is fully encrypted, headers included (hence cookies), only the Host you are sending the request to is not encrypted. It also means that the GET request is encrypted (the rest of the URL).
Although an attacker could force a client to respond over HTTP, so it is highly recommended to use the “Secure” flag in your cookie, which enforce the use of HTTPS to send cookies.
Also, using the flag HTTPOnly would greatly enhance the security of your site since it does not allow Cookies to be read with Javascript code (Mitigating potential XSS vulnerabilities).