# For cookie containing access\_token, setting secure = false, is that bad practice?

**URL:** <https://community.auth0.com/t/for-cookie-containing-access-token-setting-secure-false-is-that-bad-practice/92373>\
**Category:** Get Help\
**Created:** [October 13, 2022, 8:25pm UTC](https://community.auth0.com/t/for-cookie-containing-access-token-setting-secure-false-is-that-bad-practice/92373 "2022-10-13T20:25:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![i-said-no-cops](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/i-said-no-cops/32/39812_2.png) [@i-said-no-cops](https://community.auth0.com/u/i-said-no-cops)\
**Post date:** [October 13, 2022, 8:25pm UTC](https://community.auth0.com/t/for-cookie-containing-access-token-setting-secure-false-is-that-bad-practice/92373/1 "2022-10-13T20:25:17Z")

</div>

I’m using svelte kit JS framework. The auth pattern I have is: the user signs into auth0, the client server then retrieves the access\_token, uses jwt to sign it with our private key (still on the server), and sends it to the client as a cookie. The client server then checks for that cookie on every request. The secure flag must be set to false for the cookie to show up on the client side and be accessible with javascript. Is this still secure? It is being signed as a jwt on the server with a private key so I’m thinking that might be fine? Ex.

```auto
cookies.set(
                'token', 
                jwt.sign(data.access_token, [import private key] ),
                { sameSite: 'lax', httpOnly: true, path: '/', secure: false }
            )

```

Thanks

---

<div class="post-metadata">

**Author:** ![i-said-no-cops](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/i-said-no-cops/32/39812_2.png) [@i-said-no-cops](https://community.auth0.com/u/i-said-no-cops)\
**Post date:** [November 2, 2022, 5:02pm UTC](https://community.auth0.com/t/for-cookie-containing-access-token-setting-secure-false-is-that-bad-practice/92373/2 "2022-11-02T17:02:12Z")

</div>

Answered [here](https://security.stackexchange.com/questions/265477/for-cookie-containing-access-token-setting-secure-false-is-that-bad-practice)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 13, 2024, 6:32am UTC](https://community.auth0.com/t/for-cookie-containing-access-token-setting-secure-false-is-that-bad-practice/92373/3 "2024-12-13T06:32:16Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.