Ability to set a cookie as 'secure'

[ondrasak]

Problem

I need to set cookies with ability to flag them as 'secure'

Proposal

A) Set cookie as 'secure' implicitly if current protocol is 'https'

could bring unexpected issues (one is mentioned in the 'cons' list)

Pros

• no need to extend the interface of the 'write' method

Cons

• there could be situations when you'll need to set a cookie without this 'secure' flag (although an app is served by 'https' protocol)

B) Pass an options {isSecure: boolean} as 3th param to the 'write' method

Pros

• ability to set if a cookie will be stored as secure or not

Cons

• need to extend & maintain the interface of the 'write' method

[wstam88]

Any updates about this issue?

[taylorgoolsby]

Is there any other fallbacks for safari private mode besides cookies which is persistent across refreshes?

globalStorage, which looks like is based on persist-js, is silent on whether or not it supports safari private mode: jeremydurham/persist-js#39

I don't want to use cookieStorage without secure because I've heard about attacks (or accidents) where the client can be forced to send over http instead of https, and I put sensitive stuff in the client storage. It would be nice to have this layer of security which secure provides.

---

Also, as for option A versus option B as the OP describes, I like how option A is automatic and easier to maintain. I think it would be nice if option A was enabled by default, and you can pass a third parameter to disable it, so it's like a combination of both options.

[Lawlez]

I am also looking for this functionality, I'm tasked with finding a solution for safari and the future updates to the rest of the browsers. There should be options to set any of the cookie attributes so we can still use store.js in the future.

Maybe it could also be added as a plugin to allow for more control when setting cookies?

see here for options / best practice: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

[mt-micky]

Why is this not merged yet?? :'(