Without explicitly setting the Secure attribute in your SetCookieOptions, browsers will still gladly transmit that cookie over an unencrypted plain HTTP request (for example, if a user types http:// instead of https:// before your server redirects them).
To prevent network eavesdropping and session hijacking during that initial unencrypted window, the Secure flag must be manually and explicitly enabled.
Without explicitly setting the Secure attribute in your SetCookieOptions, browsers will still gladly transmit that cookie over an unencrypted plain HTTP request (for example, if a user types http:// instead of https:// before your server redirects them).
To prevent network eavesdropping and session hijacking during that initial unencrypted window, the Secure flag must be manually and explicitly enabled.
