mercredi 25 novembre 2020

Secure Cookie on `http://localhost`

I'm trying to set a secure cookie on localhost:

Set-Cookie: loggedUser=brillout; Max-Age=315360000; Path=/; HttpOnly; Secure

But Chrome complains:

This Set-Cookie was blocked because it had the "Secure" attribute but was not received over a secure connection.

Removing Secure while in development is unfortunately not possible: the cookie is set in a library and the library cannot easily know whether it is being used in production or in dev.

Is it possible to use Secure on http://localhost?

According to MDN it should work:

A cookie with the Secure attribute is sent to the server only with an encrypted request over the HTTPS protocol, never with unsecured HTTP (except on localhost)




Aucun commentaire:

Enregistrer un commentaire