I am trying to understand what the cookie settings httponly and secure actually do. The top answer on Google says:

Secure - This flag ensures that cookies can only be transmitted over HTTPS connections, which use SSL/TLS encryption to protect data.

httponly - This flag prevents client-side scripts, such as JavaScript, from accessing cookies

However I am running my application locally on http://localhost:3000 not https.

and also I am using JavaScript on my front end to include the cookie in Headers for my api requests using credentials:"include". I am guessing the credentials:"include" uses some other method to attach cookies to my javascript api headers but it is still a bit confusing what is happening here.

Lastly, what I find most confusing is that without these two properties my cookies were not being included in the headers of my api call. It seems to me that these properties are adding constraints so I don’t understand why removing them would cause the cookie to be omitted from the api headers.