How does cookies "secure" attr work to determines whether cookie itself should be included?
e.g.
[HTTP(unencrypted) connection]
1. user has no cookie yet and tries to log in;
2. user logs in successfully, server should send "secure" cookie to client;
- Will server send cookies to client via HTTP connection?
- Is server the one who is responsible to check the connection and decide to include "secure" cookie?
- Or cookies with "secure" attr are rejected on HTTP level?