Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
ImpactSetting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`.**Note**
This vulnerability does not affect session cookies.The following code does not issue a cookie with the secure flag even if you set `$secure = true` in `Config\Cookie`.PatchesUpgrade to v4.2.7 or later.WorkaroundsSpecify the options explicitly.Use Cookie object.Referenceshttps://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookiehttps://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter\HTTP\Response::setCookieFor more informationIf you have any questions or comments about this advisory:Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)