> For the complete documentation index, see [llms.txt](https://sumeru.gitbook.io/sumeru-cyber-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sumeru.gitbook.io/sumeru-cyber-security/common-vulnerabilites/http-only-and-secure-flag.md).

# HttpOnly and Secure Flag

## Introduction

**HttpOnly** is a flag added to cookies that tell the browser not to display the cookie through client-side scripts (document.cookie and others). The agenda behind HttpOnly is not to spill out cookies when an XSS flaw exists, as a hacker might be able to run their script but the fundamental benefit of having an XSS vulnerability is lost.

 **Secure flag** is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text.

## How to test

we can use the browser extension for view the cookies and flags are set or not.

#### For Chrome

Use [EditThisCookie](https://chrome.google.com/webstore/detail/editthiscookie/fngmhnnpilhplaeedifhccceomclgfbg?hl=en) extension to view the cookies.

#### For Firefox

Use [Cookie Editor](https://addons.mozilla.org/en-US/firefox/addon/edit-cookie/) extension to view the cookies.

#### Steps

1. Install the extension in your browser.
2. Go to the site and open the cookie extension.
3. You can see the each cookie and the flag is set or not

![](/files/-LvJlM3p1M22nMyBoaU6)

## Solutions

### PHP

#### Method 1

We can access to the php.ini file, add below code in end of the file to make the HttpOnly and Secure flag.

```
session.cookie_httponly=On
session.cookie_secure=On
```

#### Method 2

We can add the `ini_set` function in top of the each php page.

```
ini_set('session.cookie_httponly',1);
ini_set('session.use_only_cookies',1);
ini_set('session.cookie_secure', 1);
```

#### Method 3

We can also use `header` function to mark the cookie as HttpOnly and Secure flag. We have to add in top of the each php page.

```
header("Set-Cookie: key=value; path=/; domain=www.tutorialshore.com; HttpOnly; Secure; SameSite=Strict");
```

### ASP.NET

We have to access the web.config file and add the below code to make the HttpOnly and Secure flag.

```
<system.web>
  <httpCookies httpOnlyCookies="true" requireSSL="true" lockItem="true" />
</system.web>
```

### NODE.JS

We have to insert the below code in the program.

```
res.cookie('sessionid', '1', { httpOnly: true });
```

###

## References

1. <https://www.tutorialshore.com/make-cookie-secure-httponly-php/>