An application uses the 'Secure' cookie flag. A developer argues this means the cookie value is encrypted. Is this correct?

• A.No - the Secure flag only controls transmission: it tells the browser to send the cookie only over HTTPS connections, never over plain HTTP. The cookie value itself is not encrypted at the application layer by this flag - it is protected only by TLS in transit
• B.Yes - the Secure flag makes the browser encrypt the cookie value with the TLS session key before storing it: the value on disk is unreadable, never exposed to other users of the device, a protection that holds even if the profile folder is copied to another machine of the same type
• C.Yes - the Secure flag hashes the cookie value with SHA-256 before sending: the server compares the hash, never the raw value, a step that keeps the original secret away from the network path from the browser to the host
• D.No - Secure is a flag that only blocks JavaScript access: the value is still sent in plain text over HTTP, a risk that the HttpOnly flag covers for scripts running in the page