Secure Cookies question. Am I right that if the cert on the site isn't trusted, because it's a dev site that uses a wildcard cert from another domain of ours, then cookies will show in the chrome dev console as not secure, and not http only? Not secure I expected due to the cert, but I thought http only would still be honored. The box is checked in cf admin.

I don’t think that is the case.

httpOnly

and

secure

are flags on the actual cookies which are part of the

Set-Cookie

http response header. So you can check by going into the network tab and looking at the actual HTTP response headers

Thanks @foundeo. Firefox dev tools > storage > cookies shows 3 cookies, CFIF, CFTOKEN, and JESSIONID. Only JSESSIONID shows as secure and httpOnly. Network > response cookies shows only JSESSIONID, which is secure and httpOnly. Is this a reasonably secure posture?

try deleting your existing cookies first, if you toggled j2ee sessions on, you might have some old cookies hanging around

OK, will try clearing them. What's the chance of samesite=lax breaking anything?

pretty low since some browsers now default to SameSite=lax when samesite is missing, so chances are you would have seen any problems by now

OK, thanks.