title: Why does cookie have to have secure=true when SameSite=none?
body: <p>I don't see the security concern when I do <code>secure=false</code> and <code>SameSite=none</code>. If a sensitive cookie is sent over http, anyone can intercept it, and forge a request on their own computer. Of course, because its their own computer, they can spoof the origin to get around <code>SameSite</code>. So <code>SameSite=Strict</code> provides no protection if <code>secure=false</code>. I don't see why it's not allowed to set <code>secure=false</code> and <code>SameSite=none</code>.</p>