ssl-cookie-without-secure-flag-set

 HTTPOnly flag


https://portswigger.net/kb/issues/00500200_ssl-cookie-without-secure-flag-set

https://stackoverflow.com/questions/3773605/how-can-i-make-cookies-secure-https-only-by-default-in-rails