How do cookies' "secure" flag work to determine whether cookie itself should be included?
e.g. on an HTTP (unencrypted) connection...
- user has no cookie yet and tries to log in;
user logs in successfully, server should send "secure" cookie to client;
- Will the server send cookies to the client via HTTP?
- Is server the one who is responsible to check the connection and decide to include "secure" cookie?
- Or are cookies with "secure" flag rejected on HTTP level?