I am aware that the Secure flag for cookies can be set either in Webserver configuration or in the application. What would be the best approach? Fix them in the code, or fix them in the Webserver? Or fix them at both the places? A lot of times, I have seen IT teams fixing this vulnerability only on the webserver configuration, leaving the application code untouched. Any downside in setting the cookie only in the Webserver and not in the application?