code: private void secureCookie(Cookie cookie, HttpServletRequest request){
          // if we can mark the cookie HTTP only, do so to protect this cookie even in case of XSS vulnerability.
          if (SET_HTTP_ONLY!=null) {
              try {
                  SET_HTTP_ONLY.invoke(cookie,true);
              } catch (IllegalAccessException | InvocationTargetException e) {
                  // ignore
              }
          }
  
          // if the user is running Jenkins over HTTPS, we also want to prevent the cookie from leaking in HTTP.
          // whether the login is done over HTTPS or not would be a good enough approximation of whether Jenkins runs in
          // HTTPS or not, so use that.
          cookie.setSecure(request.isSecure());
      }
docs: Force always the http-only flag and depending on the request, put also the secure flag.