Secure

Meaning

Secure is a cookie attribute that tells the browser to send the cookie only over encrypted connections, which in practice means HTTPS. MDN adds that localhost is an exception for development. It stops a session identifier from travelling in clear text on a shared network, and current browsers also generally refuse to let an insecure response set or overwrite a Secure cookie. It only helps if the whole site uses HTTPS. Secure is required with SameSite=None, Partitioned and both cookie prefixes. See also: HttpOnly, SameSite None, Cookie prefix, the guide "Secure, HttpOnly and the __Host- and __Secure- Prefixes".