title: Does it make sense to add secure and httpOnly flags to an expired cookie?
body: <p>One of our clients made a penetration test on our application and reported missing flags when working with cookies.</p>
  
  <p>We should always use <code>httpOnly</code> and <code>secure</code> flags when setting cookies.</p>
  
  <p>After some testing I realized that cookies were actually using this flags when set, but with one exception: Log out.</p>
  
  <p>When logging out some cookies were set with a past expiration date, as to delete that <code>cookie</code>, <code>secure</code> and <code>httpOnly</code> were not used. </p>
  
  <p>Does this represent a security risk? Does it make sense to set these flags when setting an expired cookie?</p>