Documentation clarification (.remove and secure flag)
See original GitHub issueIn the specification, regarding removal of cookies (.remove), the following is specified:
IMPORTANT! when deleting a cookie, you must pass the exact same path, domain and secure attributes that were used to set the cookie, unless you're relying on the default attributes.
During my testing, it seems this is true for domain and path, but it does not seem to be true for secure. We set the cookie to secure on the server (Chrome Developer Tools confirms this), but it seems to be possible to remove the cookie without setting the secure flag. Explicitly removing with secure: false seems to work as well. Should this not work (indicating I am doing something wrong, which might entirely be the case), or am I misunderstanding the documentation?
Issue Analytics
- State:
- Created 7 years ago
- Comments:14 (10 by maintainers)
Top Results From Across the Web
HTTP pages are removing my secure cookies - Stack Overflow
HTTP pages are removing my secure cookies · a regular cookie with her (signed) username, login expire time, and an "insecure" flag ·...
Read more >Secure flag for cookie - DevCentral
The secure flag governs what type of connection a cookie is submitted over (when the secure flag is set, HTTPS only, if secure...
Read more >Is it imporant that a cookie should have secure flag set if the ...
The secure flag tells the browsers to only send a cookie if the request is being made over HTTPS.
Read more >Enable secure session cookies and set application cookies as ...
Web browsers supporting the "secure" flag only send cookies having the "secure" flag when the request uses HTTPS. This means that setting the...
Read more >HTTP response can overwrite cookie with secure flag - Monorail
However, this overwriting is possible in Chrome and the exemplary aforementioned attacks are possible. Fix proposal - check if HTTP response ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found

I’ll say, you guys are quick at responding! I created a PR with
secureremoved from the text (and fixing a were -> was, sorry :p). It’s right here: https://github.com/js-cookie/js-cookie/pull/204Please let me know if I did anything wrong in the PR, I am not a very seasoned contributor to open source projects.
Thanks for the clarification!
Created a PR. See https://github.com/js-cookie/js-cookie/pull/369.