Secure Cookie Attribute

Restricts a cookie to HTTPS requests, except for special localhost behavior in browsers.

Set `Secure` on session and authentication cookies so they are not sent over plaintext HTTP.

cookiessecurityhttpssessions

Session cookie (http)

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/

Secure is a transport requirement, not an encryption mechanism for the cookie value itself. Use it together with HTTPS and HttpOnly for session cookies.

If a cookie must work on a local development environment, configure development behavior deliberately rather than weakening production cookies.

Common mistakes

Storing sensitive tokens in cookies without Secure and HttpOnly.
Assuming Secure protects a cookie from JavaScript; HttpOnly handles that concern.

HttpOnly Cookie Attribute SameSite Cookie Attribute Strict-Transport-Security (HSTS)

Sources

MDN Web Docs: HTTP