> But after restarting Shib the Secure flag is still being used. Is this a bug (I > searched for a bug related to this but didn't find anything), or am I just missing > something? Any cookies the IdP sets are governed by it, others are not and would be controlled in whatever way governs them. -- Scott