Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
Normally, browsers should not send cookies that have Secure option if connection is unsecured (i.e. http instead of https).
Is there a configuration option or a plugin that would allow to change this behaviour for particular domain in Firefox or Chrome?
I would like to use such option for convenience when developing application (on localhost).
The best way to make the browser stop enforcing the ;secure flag is, don't send the ;secure flag to the browser when setting the cookies. Configure the server to leave off the ;secure flag during those activities where you want to use HTTP. If the server does not send the ;secure attribute, the browser will allow you to send the cookie over HTTP.
If you develop the application and control both the client and server, you should be able to do this easily. The specific steps to configure use of the ;secure depend on your server side tools. In Java EE there is a standard xml configuration option, for example. In most java frameworks there are more ways to control and configure headers and cookies. In ASP.NET, I recall there were also plenty of server side options to control.
If you want to use ;secure in test and production, then you could build your product with ;secure cookies enabled by default, but turn off ;secure at the server when needed in a development environment.
If you want the browser to ignore the ;secure flag I guess, theoretically you could dig up a really old browser from before that flag was added.
Even with HTTPS, it's easy to see unencrypted requests and responses in a browser's developer tools. And it's possible to use a proxy tool to act as 'man in the middle' for debugging, dumping plain text traffic while the browser uses https. On windows a simple free tool for this is Fiddler. On linux and Mac OS it can be done with Wireshark but not as simple to set up. I mainly find the proxy approach useful when the https client is not a browser.
