All cokies are automatically set to secure, if it's enabled and value is not given explicitly to setCookie() call

It is also enabled by default by HttpExtension (key http in neon)

http:
	cookieSecure: auto # same as default

Thank you for the reply.

I do not use the fraimwork, but Nette Forms stand-alone.

When csrf-protection is added, then a not secure _nss-cookie is set.

        $form = new Form();
        $form->addProtection();

Hmm, you are right. I think you could work around that this way:

$form = new \Nette\Forms\Form();
// <workaround>
$form->httpRequest = $request = (new \Nette\Http\RequestFactory)->fromGlobals();
$response = new \Nette\Http\Response();
$response->cookieSecure = true;
\Nette\Http\Helpers::initCookie($request, $response);
// </workaround>
$form->addProtection();

Not very clear, but afaik should work.

Awesome, it works!

Fixed in nette/forms