&gt; If someone is logged in and then back to normal http, someone can just grab the cookie and pretend to be that person already-logged-in.<p>If the cookie is set through HTTPS, the browser won&#x27;t send it when loading HTTP resources. So the cookie won&#x27;t be exposed that way.<p>We should still be using HTTPS for all traffic in 2016.