The secure properties of cookies are detailed _cookie

The project today involves the problem of passing a cookie across domains, and hence the understanding of a property--secure of the cookie.

As the name suggests, this property is used to keep cookies safe.

When the secure property is set to True, cookies are uploaded to the server under the HTTPS protocol and cannot be uploaded under the HTTP protocol, so they are not tapped.

In simple practice, the Chrome browser opens https://www.baidu.com and http://www.baidu.com, opens the console separately (the console in the HTTPS page below is called Console1,http console2)

1. First enter the following code in the Console1

Document.cookie = "Name=ex;expires=60*24*7;secure=true";
Then, with resources open, you can see that the corresponding fields have been recorded in the cookie

2. The same operation in the Console2, then to look at the HTTP protocol under the Baidu page of resources, you will find that the name field did not upload to the server

3. What if I set the secure to false?

This article Baidu as an example, set to false result is no matter which agreement you under the Baidu page set cookies, then on both sides of the Baidu page cookie can see the field.

The implementation of a cookie across the protocol, but at the same time there is a certain probability of the risk of eavesdropping.

The above is the entire content of this article, I hope to be able to help you learn cookies.