Secured and encrypted cookie via HTTPS

Question

Hi! I want to ask about secured cookies via HTTPS. Should secured cookie be automatically encrypted or not? Why do I can see value of secure cookie in the browser ? Is secured cookie != encrypted cookie ? Greetings! Chris

Vinay Singh · Answer

Data sent over SSL (HTTPS) is fully encrypted headers included (hence cookies) only the Host you are sending the request to is not encrypted. It also means that the GET request is encrypted (the rest of the URL). Although an attacker could force a client to respond over HTTP so it is highly recommended to use the Secure flag in your cookie which enforce the use of HTTPS to send cookies. Also using the flag HTTPOnly would greatly enhance the security of your site since it does not allow Cookies to be read with Javascript code (Mitigating potential XSS vulnerabilities). for more detail check the link http://stackoverflow.com/questions/19862854/cookie-security-when-passed-over-ssl

Krzysztof Krawiec · Answer

Thank U for your fast replay but still... look on the screenshoot What do I miss ? Greetings! Chris