Question

I have a class that has a function, lets say class.php:

class fun {
public function get_cookie() {
$old_cookie = $_COOKIE['mycookie'];
}
public function ssl() {
//redirect from http to https
}

In another php file, lets say index.php:

//include fun class
$fun = new fun;
$fun->ssl();
$fun->get_cookie();

My question is since the function get_cookie is after $fun->ssl() does the user send the cookie encrypted? or since the cookie code is coded before the $fun->ssl() is executed, the cookie gets sent unencrypted?

Answer 1

Never send anything via cookies which requires encryption.

Regardless of the answer to the actual question posed here, the contents of your cookies should be considered to be publically accessible and insecure.

Firstly, the entire set of cookies for the site is sent (in both directions) with every single web request. So even if you successfully encrypted them with SSL in this particular request, the user would only need to make a plain HTTP request for an image on your site, and he’d transmit them and get them sent back unencrypted.

Secondly, it is not unheard of for cookies to leak between sites. Many cross-site scripting hacks exist which can allow third-parties to get hold of your user’s cookies. These would not be stored encrypted on the user’s machine, even if they were sent via SSL.

So I’ll repeat my initial statement again: never send anything via cookies which you need to keep secure.