Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original cookies were set using HTTPS/SSL and the current page is HTTP.
One way around this is by setting the "secure" flag on cookies you set. Any cookies set with the "secure" flag will only get transmitted by browsers when connecting to HTTPS pages. In recent versions of ExpressionEngine there are a few ways to do this. One way is by setting this config variable:
$config['cookie_secure'] = 'y';
That'll make sure all cookies set by EE get the secure flag (note: the server must be configured to set the HTTPS environment variable). If you only want to set it for some cookies, you can use the set_cookie_end
extension hook to put custom logic around cookie requests, making the important ones secure.
Remember that if you use secure cookies for things like the session cookie, cart sessions, etc... those things won't persist in HTTP requests which might lead to some weird UX if you don't account for it in URLs and redirects.
As far as how much trouble bad actors can make with cookies, it depends. With some settings, ExpressionEngine will try to fingerprint session IDs with information like the user agent and other data. This can help because EE won't authenticate a session if the information doesn't match.
The safest approach is to operate over only HTTPS and set all cookies to secure
(and HttpOnly
, which EE now does as default). Hardware is very fast with SSL/TLS these days so unless you're running with a lot of traffic or on a complicated setup, you probably won't see much a performance issue.
Let me know if I can provide any other information on this!