I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.
A secure cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol. ....
Note: Insecure sites (http:) can't set cookies with the "secure" directive anymore (new in Chrome 52+ and Firefox 52+).
In other words: it makes no sense to set
secure on plain HTTP at all since a cookie with such a settings would essentially be ignored.