FrontendHaltSecurity·Beginner·Conceptual·1 min read
Is HTTPS required for cookie-based sessions to be meaningful?
Short interview answer
Effectively yes — without it, a session cookie can be observed in plaintext over the network, and the Secure attribute itself requires HTTPS to have any enforcement effect.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.