← Back to release summary

Strict Secure Cookies

Category
Security
Type
New or changed feature
Status
Enabled by default (Chrome 58)
Intent stage
None

Summary

This adds restrictions on cookies marked with the 'Secure' attribute. Currently, Secure cookies cannot be accessed by insecure (e.g. HTTP) origins. However, insecure origins can still add Secure cookies, delete them, or indirectly evict them. This feature modifies the cookie jar so that insecure origins cannot in any way touch Secure cookies. This does leave a carve out for cookie eviction, which still may cause the deletion of Secure cookies, but only after all non-Secure cookies are evicted.

Standards & signals

Docs: https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie

View on chromestatus.com