Normally, browsers should not send cookies that have Secure option if connection is unsecured (i.e. http instead of https).

Is there a configuration option or a plugin that would allow to change this behaviour for particular domain in Firefox or Chrome?

I would like to use such option for convenience when developing application (on localhost).

  • I don't know but I doubt it; such a backdoor would be an obvious attack vector for malware. Commented Feb 21, 2016 at 22:37
  • @PreferenceBean well, cookies can be viewed and edited in a browser, so when you have a malware which can mess with the browser you are screwed anyway
    – TMG
    Commented Feb 21, 2016 at 22:56
  • Can they be edited? Commented Feb 21, 2016 at 23:36
  • @PreferenceBean yes, with an extension like Cookie Inspector for Chrome
    – TMG
    Commented Feb 22, 2016 at 9:00
  • 2
    This question belongs to stackoverflow.com
    – Basilevs
    Commented Sep 8, 2020 at 6:09

1 Answer 1


The best way to make the browser stop enforcing the ;secure flag is, don't send the ;secure flag to the browser when setting the cookies. Configure the server to leave off the ;secure flag during those activities where you want to use HTTP. If the server does not send the ;secure attribute, the browser will allow you to send the cookie over HTTP.

If you develop the application and control both the client and server, you should be able to do this easily. The specific steps to configure use of the ;secure depend on your server side tools. In Java EE there is a standard xml configuration option, for example. In most java frameworks there are more ways to control and configure headers and cookies. In ASP.NET, I recall there were also plenty of server side options to control.

If you want to use ;secure in test and production, then you could build your product with ;secure cookies enabled by default, but turn off ;secure at the server when needed in a development environment.

If you want the browser to ignore the ;secure flag I guess, theoretically you could dig up a really old browser from before that flag was added.

Even with HTTPS, it's easy to see unencrypted requests and responses in a browser's developer tools. And it's possible to use a proxy tool to act as 'man in the middle' for debugging, dumping plain text traffic while the browser uses https. On windows a simple free tool for this is Fiddler. On linux and Mac OS it can be done with Wireshark but not as simple to set up. I mainly find the proxy approach useful when the https client is not a browser.

  • There's an alpha version of Fiddler for Linux & Mac (based on mono). You can also proxy through Fiddler running on a separate Windows host.
    – Mat
    Commented Feb 22, 2016 at 6:37
  • @Mat Nice to know.
    – joshp
    Commented Feb 23, 2016 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.