What are secure cookies?

Secure cookies are cookie files with the Secure flag set. This flag instructs the browser to send the cookie to the server only over a secure connection (HTTPS).

They provide an additional layer of security by protecting cookie data from interception during transmission over unencrypted HTTP connections.

Key aspects:

• Require HTTPS: The browser ignores the Secure flag for HTTP connections.
• Protection from interception: Prevent man-in-the-middle (MITM) attacks.
• Privacy: Help protect confidential data stored in cookies.
• Do not protect against XSS: The Secure flag does not prevent access to cookies via cross-site scripting (XSS) vulnerabilities. For this, HttpOnly flags are used.

Example of setting on a server (Node.js with Express):

// Setting a cookie "session_id" with value "xyz123"
// Secure flag = true indicates sending only over HTTPS
res.cookie('session_id', 'xyz123', { secure: true }); 

Example of setting on a server (PHP):

// Setting a cookie "user_token" with value "abc456"
// 'secure' => true parameter indicates sending only over HTTPS
setcookie('user_token', 'abc456', [
    'expires' => time() + 3600,
    'path' => '/',
    'secure' => true,     // Send only over HTTPS
    'httponly' => true,   // Not accessible via JavaScript
    'samesite' => 'Strict' // CSRF protection
]);