Drupal 8 secure session
The HTTP flag is being set by your browser as you're accessing Drupal over HTTP (and thus vulnerable to cookie hijacking). Drupal creates 2 different cookies (an unsecure HTTP one, and a secure HTTPS one) depending on what protocol it detects. 

If you want only secure sessions, force HTTPS at the web server or application level (depending on your stack configuration).