secure flag on cookies prevent them from being read by an insecure (non-HTTPS) site, but they can still be written or deleted from an insecure site. There are two new browser features that try to prevent that:
It seems to me that the
__Secure- prefix also makes the cookie strictly secure.
How do these two features compare with each other? Why are there two seperate solutions for overwriting cookies? Do I still need the cookie prefix if my clients have a browser with strict secure cookie support?