← Back to glossary
🍪

Secure Cookie Flag

Web Security

TLS (Transport Layer Security) HTTPS Cookie Session Cookie

Cookie attribute restricting transmission to HTTPS; reduces exposure to network interception and downgrade.

Definition

Secure cookies are only sent over HTTPS. This protects cookies from being transmitted in cleartext. It should be used alongside HSTS to reduce downgrade risk.

In plain English Cookie attribute restricting transmission to HTTPS; reduces exposure to network interception and downgrade.

Why this matters

Why it matters: Session cookies transmitted over HTTP can be stolen on hostile networks.

Example

Example: Set Secure for all session/auth cookies and enforce HTTPS site-wide with HSTS.