What does the Secure flag do?

The answer

The Secure flag tells the browser to send the cookie only over encrypted connections, which means HTTPS. MDN notes that localhost is an exception for development. Current browsers also generally refuse to let an insecure response set or overwrite a Secure cookie, which blocks a trick where a network attacker plants a cookie. It only protects you if the whole site uses HTTPS, so pair it with redirects from HTTP and, where appropriate, Strict-Transport-Security.