What Does the Secure Attribute Stop?

About this interactive

A cookie is a small piece of data a site stores in your browser, so it can remember your session (that you are logged in, what is in your cart), your preferences (dark mode) or, for trackers, what you looked at. Two risks follow. Privacy: tracking cookies, usually set by ad networks embedded across many sites, can build a picture of where you go. Session hijacking: someone who steals your session cookie can use it to take over your session. The Secure attribute is set by the server, by the people who run the application. It tells the browser to send that cookie only over HTTPS connections, so it never appears in unencrypted traffic that someone on the network could read. That is all Secure does. The video says the browser encrypts the cookie and locks it to certain sites; neither is the Secure attribute. Browsers already keep each site's cookies from other sites. A script in the page, malware on the computer, a cookie that lasts too long, or a request triggered from another site are each handled by other settings and controls, such as HttpOnly and SameSite.

What you'll learn

Decide whether the Secure cookie attribute stops a given risk: it keeps the cookie off unencrypted HTTP, and nothing more
Explain why cookies matter for security: session cookies can be stolen to hijack a session, and tracking cookies raise privacy concerns

Aligned to

CompTIA Security+

4.1 Given a scenario, apply common security techniques to computing resources.

Key terms

Cookie: A small data file stored on a user's device by a web browser to track session state, preferences, and user activity across visits to a website.
Session Hijacking: An attack in which a threat actor takes over an authenticated session by stealing or forging the session token, gaining unauthorized access to resources without needing the user's credentials.
Transport Layer Security: A cryptographic protocol that provides secure communication over a network, successor to SSL.
Confidentiality: The principle that information is accessible only to those authorized to access it.

Topics

Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →