CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
An application uses the 'Secure' cookie flag. A developer argues this means the cookie value is encrypted. Is this correct?
- A.Yes - the Secure flag activates cookie-level encryption
- B.The Secure flag encrypts the cookie with the server's TLS certificate
- C.No - the Secure flag only controls transmission: it tells the browser to send the cookie only over HTTPS connections, never over plain HTTP. The cookie value itself is not encrypted at the application layer by this flag - it is protected only by TLS in transit
- D.Secure flag both encrypts the cookie and restricts it to HTTPS
Why C is correct
The Secure attribute is a transmission control flag, not an encryption directive. It prevents the cookie from being sent over unencrypted HTTP connections. The cookie value itself is stored in plaintext on the client's filesystem (browser cookie store) and visible in browser developer tools. If the cookie contains sensitive data, it should be encrypted at the application layer separately. The Secure flag only ensures the value is not intercepted in transit by a network attacker.
Know someone studying for Web App Fundamentals? Send them this one.