Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to allow cookies for a domain but only over HTTPS -- not cookies from the same domain that come from HTTP. For example, I don't want any http://www.google.com cookies, but I do want to allow https://www.google.com cookies (because Calendars are there).

Is there a way to do this? Does the goal even make sense?

In Chrome, it only allows domain names, not URLs, to be added to the cookie exception list. In Firefox, it allows a protocol, but it only records the domain name, and if you click "Allow" or "Deny", it changes the same entry in the list.

share|improve this question
3  
Maybe it matters for you; if so then you might need to limit your question even more: cookies that are served through HTTPS, but do not have the secure flag set, will also be sent back to the web server when using plain HTTP. –  Arjan Jan 18 '11 at 18:27
add comment

2 Answers

NoScript for firefox solves this problem:

http://noscript.net/faq#qa6_1 (last three lines of the paragraph)

Details here: http://hackademix.net/2008/09/10/noscript-vs-insecure-cookies/

share|improve this answer
    
+1 - I was going to suggest building an extension, but it looks like one already exists. –  jmort253 Feb 5 '11 at 8:55
    
And NoScript is a very good one, have a look to their changelogs if you want to learn that you know nothing to javascript security ^^ –  Shadok Feb 7 '11 at 16:07
add comment

Is there a way to do this?

Privoxy can do this for you and works for the browsers you change the proxy of.

As it doesn't handle HTTPS traffic it will only filter HTTP traffic, you could use cookie crunching

The user.action file should look similar to this:

{ +crunch-incoming-cookies +crunch-outgoing-cookies }
/ # Match all URLs

Does the goal even make sense?

Although it will make you more secure, I don't see the need to do it.

You might as well break some sites you use on a daily basis, but Privoxy allows you to allow those sites...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.