-1

Normally, browsers should not send cookies that have Secure option if connection is unsecured (i.e. http instead of https).

Is there a configuration option or a plugin that would allow to change this behaviour for particular domain in Firefox or Chrome?

I would like to use such option for convenience when developing application (on localhost).

  • I don't know but I doubt it; such a backdoor would be an obvious attack vector for malware. – Lightness Races in Orbit Feb 21 '16 at 22:37
  • @PreferenceBean well, cookies can be viewed and edited in a browser, so when you have a malware which can mess with the browser you are screwed anyway – TMG Feb 21 '16 at 22:56
  • Can they be edited? – Lightness Races in Orbit Feb 21 '16 at 23:36
  • @PreferenceBean yes, with an extension like Cookie Inspector for Chrome – TMG Feb 22 '16 at 9:00
  • @Whoever_downvoted_the_question - please explain what's wrong with it – TMG Feb 22 '16 at 9:01
2

The best way to make the browser stop enforcing the ;secure flag is, don't send the ;secure flag to the browser when setting the cookies. Configure the server to leave off the ;secure flag during those activities where you want to use HTTP. If the server does not send the ;secure attribute, the browser will allow you to send the cookie over HTTP.

If you develop the application and control both the client and server, you should be able to do this easily. The specific steps to configure use of the ;secure depend on your server side tools. In Java EE there is a standard xml configuration option, for example. In most java frameworks there are more ways to control and configure headers and cookies. In ASP.NET, I recall there were also plenty of server side options to control.

If you want to use ;secure in test and production, then you could build your product with ;secure cookies enabled by default, but turn of ;secure at the server when needed in a development environment.

If you want the browser to ignore the ;secure flag I guess, theoretically you could dig up a really old browser from before that flag was added.

Even with HTTPS, it's easy to see unencrypted requests and responses in a browser's developer tools. And it's possible to use a proxy tool to act as 'man in the middle' for debugging, dumping plain text traffic while the browser uses https. On windows a simple free tool for this is Fiddler. On linux and Mac OS it can be done with Wireshark but not as simple to set up. I mainly find the proxy approach useful when the https client is not a browser.

  • There's an alpha version of Fiddler for Linux & Mac (based on mono). You can also proxy through Fiddler running on a separate Windows host. – Mat Feb 22 '16 at 6:37
  • @Mat Nice to know. – joshp Feb 23 '16 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.