I understand that cookies with the secure flag should be transmitted over a HTTPS connection. It also means that these cookies should be protected from adversaries (private cookie). Thus, it is important to set the HttpOnly flag on this kind of private cookie to prevent XSS.
Is a private cookie with the secure flag but no HttpOnly flag a problem?
Essentially, I think the HttpOnly flag should be added to a cookie with the secure flag.