I was asked this question "If the cookie is marked secure and the web application is over http , Cannot we access the application ?"
Considering the secure flag is to ensure the cookie is sent only on encrypted network
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Secure-only means that the cookie won't be sent to a server using insecure (http) connection. So the application cannot rely on it from a server side.
Http only is not set (probably a bad idea tho).
Note that according to https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Secure_and_HttpOnly_cookies
Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.
So your http application wouldn't even be able to set the cookie (browser won't save it, or maybe will save it but without the
secure flag: in such case, the application might "still work" since it will receive the cookie on next
Last, you could still "access" the application, but you will be seen as "anonymous" since no cookie will be sent.