Drupal 8 secure session In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
The HTTP flag is being set by your browser as you're accessing Drupal over HTTP (and thus vulnerable to cookie hijacking). Drupal creates 2 different cookies (an unsecure HTTP one, and a secure HTTPS one) depending on what protocol it detects. 

If you want only secure sessions, force HTTPS at the web server or application level (depending on your stack configuration).