Cookie flags tie the browser down
Secure and SameSite are not checks the server performs. They are instructions the user agent follows when it decides whether to attach a cookie to an outgoing request, and the server only sees the result: a Cookie header, or nothing. That asymmetry is the point, and the trap. ...