What does the Secure flag on a cookie do?

• A. Ensures the cookie is only sent over HTTPS
• B. Encrypts the cookie contents
• C. Sets the cookie to be accessible in scripts
• D. Makes the cookie valid for all subdomains

Answer: (A)

The Secure flag restricts when a cookie is sent by the browser. When this flag is set, the cookie will only be included in requests that are transmitted over a secure connection (HTTPS). This helps protect the cookie from being exposed if someone is eavesdropping on an insecure network, since the value isn’t sent over plain HTTP.

It’s important to note that Secure does not encrypt the cookie contents itself; encryption is provided by using TLS/HTTPS for the connection. It also doesn’t control whether a cookie can be accessed by client-side scripts (that’s the role of HttpOnly) or which domains or paths receive the cookie (that’s controlled by Domain and Path attributes).