Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

No. Providing the cookies are set with secure flag (https://www.owasp.org/index.php/SecureFlag), that will mean the browser won't send the cookie over http requests, only on https requests, and to answer the other comment below about 'JS snarfing', that is mitigated by setting the cookie as httpOnly (https://www.owasp.org/index.php/HTTPOnly) which doesn't mean http vs https, it means not accessible via DOM JavaScript.


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: