Why are session id cookies not secure

Question

When I look in the code for setting the session ids I see the code below. I am confused as I understood that the purpose of setting the Secure flag on a cookie was to indicate that the cookie should only be sent on a secure connection. In the code below we only set the this flag of the connection is already secure. How does this serve the purpose of preventing the session id being sent over an insecure connection?

I am still trying to think through whether it even matters? Are we vulnerable to 'main the middle' attacks if the session id is sent as clear text?

if (httpRes != null)
            httpRes.Cookies.AddPermanentCookie(SessionFeature.PermanentSessionId, sessionId,
                (HostContext.Config.OnlySendSessionCookiesSecurely && req.IsSecureConnection));

Answer 1

What is the point of sending a "secure" cookie in an unsecured response? That probably means that HTTPS is not available on your server and the client would subsequently make a request on an unsecured HTTP connection anyway. So even if you instructed the client to only send cookies over HTTPS connections, the fact that the current connection is not HTTPS means the next connection probably won't be either and the client would not send the cookie back to the server. So whether you're not setting the cookie in the first place or the client is not sending it back subsequently makes little difference.

Now, if you say you want to set the cookie over HTTP but only receive it over HTTPS, you're missing the point of secure cookies. If the cookie is ever transmitted over HTTP at any point, its security cannot be guaranteed and it's as good as if you didn't use secure cookies in the first place.

So, ignoring the secure flag unless the currently connection is actually secure makes perfect sense and is good practice. Arguably it should raise an exception or something instead of simply ignoring it and silently introducing insecurities though.

Answer 2

Yes you are, the session id is a cookie that the client sends to the server. Now imagine that you steal a sessionid from an Administrator and then you send a request to the Server.

If any rights/privileges/data is stored in the session you can now Access everything that this Administrator had in his session.

Answer 3

The Config.OnlySendSessionCookiesSecurely option is used to enable the Secure flag for Session Cookies. If this option is enabled then the Secure flag is set when accessed over an encrypted https connection as recommended:

for maximum security, cookies with the Secure attribute should only be set over a secure connection.

Setting the Secure flag is what instructs the browser that they should only send this cookie in subsequent requests over an encrypted connection so it only ever gets sent and resent over a secured connection.