As the title says, why aren't all the cookies out there HTTPONLY and SECURE set to True?
What are the benefits of having cookies which do not operate under these terms.
Thanks
Akimba
Why aren't all the cookies set to HTTPONLY and SECURE
Viewed 49
1 Answers
Cookies are used to store temporary data. You can save device specific preferences of a user in a cookie, if you will set the HTTPONLY flag to true you won't be able to set this data and retrieve it using JavaScript.
The SECURE flag informs the browser that cookie should only be transported over a HTTPS connection. In development environments where you are developing a website on localhost this cannot be always true. Also there are sites where HTTPS connection is not required, but user preference for example theme is stored in cookies.
Related