As per my security checking and testing in Magento 2, I see that secure cookie or HTTP only flag not set on the Magento 2.
For the security reason, we need the cookie to be secure. Can someone please help me on this.
Stores > Configuration > (General) > Web > Default Cookie Settings
Cookie Lifetime. It’s how long Cookie files stay on user’s computer. By default it’s set as 3600 seconds which is equal to about 1 hour. If you want to ensure that cookies expire when a user closes their browser, then select 0 here.
Cookie Path. To make cookies available for some particular folders, enter the Cookie Path here. If you want them to be available anywhere on your site, then enter a “/”.
Cookie Domain. If you want to enable cookies for a subdomain, enter it here. If you want to enable cookies for all subdomains, enter something like “.domain.com” (make sure there is a “.” before your domain name).