question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Documentation clarification (.remove and secure flag)

See original GitHub issue

In the specification, regarding removal of cookies (.remove), the following is specified:

IMPORTANT! when deleting a cookie, you must pass the exact same path, domain and secure attributes that were used to set the cookie, unless you're relying on the default attributes.

During my testing, it seems this is true for domain and path, but it does not seem to be true for secure. We set the cookie to secure on the server (Chrome Developer Tools confirms this), but it seems to be possible to remove the cookie without setting the secure flag. Explicitly removing with secure: false seems to work as well. Should this not work (indicating I am doing something wrong, which might entirely be the case), or am I misunderstanding the documentation?

Issue Analytics

  • State:closed
  • Created 7 years ago
  • Comments:14 (10 by maintainers)

github_iconTop GitHub Comments

3reactions
bendiksolheimcommented, May 23, 2016

I’ll say, you guys are quick at responding! I created a PR with secure removed from the text (and fixing a were -> was, sorry :p). It’s right here: https://github.com/js-cookie/js-cookie/pull/204

Please let me know if I did anything wrong in the PR, I am not a very seasoned contributor to open source projects.

Thanks for the clarification!

0reactions
FagnerMartinsBrackcommented, Oct 21, 2017
Read more comments on GitHub >

github_iconTop Results From Across the Web

HTTP pages are removing my secure cookies - Stack Overflow
HTTP pages are removing my secure cookies · a regular cookie with her (signed) username, login expire time, and an "insecure" flag ·...
Read more >
Secure flag for cookie - DevCentral
The secure flag governs what type of connection a cookie is submitted over (when the secure flag is set, HTTPS only, if secure...
Read more >
Is it imporant that a cookie should have secure flag set if the ...
The secure flag tells the browsers to only send a cookie if the request is being made over HTTPS.
Read more >
Enable secure session cookies and set application cookies as ...
Web browsers supporting the "secure" flag only send cookies having the "secure" flag when the request uses HTTPS. This means that setting the...
Read more >
HTTP response can overwrite cookie with secure flag - Monorail
However, this overwriting is possible in Chrome and the exemplary aforementioned attacks are possible. Fix proposal - check if HTTP response ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found