HTTP pages delete my secure cookies

Question

I have a website with mixed HTTP / HTTPS. When a user logs in, she receives two cookies:

• regular cookie with its (signed) username, login expiration time and the icon is "unsafe"
• secure cookie with its (signed) username, login expiration time and "safe" flag
  • note that if you do not have the secure / insecure flag in the signed content, the attacker can intercept a regular cookie and then send it as secure (my first implementation made this error).

I use a regular cookie on HTTP pages (only to show my name while she browses the marketing part of the site). Then I use a secure cookie when it is on HTTPS pages (any pages related to a specific user).

I got the idea of Secure Cookies and the mixed use of https / http .

Everything works fine, except when a user switches from an HTTPS page to an HTTP protocol, all protected cookies are deleted, which means that they cannot return to HTTPS pages after visiting even one HTTP page. I should mention that there is a “301 Moved Permanentently” that redirects the user from HTTPS to HTTP.

My site does not clear a secure cookie. I know that the browser should not send me a secure cookie while the user is looking at the HTTP site, but I expected that the cookie will remain for life and will be sent if the user returns to the HTTPS page again.

I get the same behavior in Chrome, Firefox and IE. Any tips? Hope this is not the expected behavior ...

Answer 1

Welp, this is embarrassment. Here is my problem.

• When a user tries to visit an HTTPS site from an HTTP server, their request will start with HTTP
• I would check their credentials (which would not work, because there was no secure cookie there), and then redirect them to HTTPS. My systems "require sign-in" and "require HTTPS" were separate (the design is poor now, but it was convenient in the bad old days when the login cookie was not secure).
• I thought my secure cookie was deleted because the Chrome cookie does not show secure cookies when the page displayed is HTTP. The cookies were there all the time.