Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a session identifiers. Should I add this flags to all three cookies?
Secure - Flag tells user-agent to send cookie in communication only if communication medium is secure (HTTPS not HTTP)
If your cookie used in any HTTP communication then you may need to disable Secure flag but its not recommended.
I'd assume you don't want to share at least
IDSESSION with malicious users, because first one probably leads to information disclosure and second - to session hijacking. If there is a probability of an XSS in your application then mentioned flags are definitely necessary.
It is recommended that you add those flags to those cookies and only remove them if you have a business need.
Secure: You should be using TLS, so this is a hard yes.