The Secure cookie attribute tells browsers to send a cookie only over HTTPS.
When a server sets a cookie with the Secure flag, the browser limits that cookie to requests made through a secure channel, normally HTTPS using TLS. This helps prevent the cookie from being exposed when a request travels over ordinary, unencrypted HTTP. A typical header might include “Secure; HttpOnly” after the cookie value.
Secure does not make a cookie completely safe. It protects transmission over the network, but it does not stop malicious scripts from reading a cookie if HttpOnly is absent, nor does it prevent every form of theft or misuse. For sensitive session cookies, developers commonly combine Secure with HttpOnly and an appropriate SameSite setting.
The other choices control different behavior. Domain determines which hosts can receive the cookie, HttpOnly blocks JavaScript access through mechanisms such as document.cookie, and SameSite limits certain cross-site requests. Secure is the attribute specifically associated with encrypted HTTPS transport, with localhost treated as a special development case by browsers.