Not super exciting, but curious: if a response sets STS header, do we still care about the secure flag on the cookie?
1
Replying to @mkonda
Yes, there’s the issue of scope mismatch, the HSTS bootstrap request, older browsers, and misconfiguration. Seems prudent to still set Secure.

Mar 28, 2019 · 12:10 AM UTC

1
1
Replying to @bilcorry
Thanks, Bil! That hit what I needed and part of it I had overlooked.
1