An application uses the 'Secure' cookie flag. A developer argues this means the cookie value is encrypted. Is this correct?

• A.No - the Secure flag only controls transmission: it tells the browser to send the cookie only over HTTPS connections, never over plain HTTP. The cookie value itself is not encrypted at the application layer by this flag - it is protected only by TLS in transit
• B.Secure flag both encrypts the cookie and restricts it to HTTPS
• C.The Secure flag encrypts the cookie with the server's TLS certificate; the browser sends at most one cookie per request, and applications multiplex all state into a single JSON-encoded value; cookies marked Secure are encrypted at rest by the browser with a per-site key, and disk theft cannot expose them
• D.Yes - the Secure flag activates cookie-level encryption