Cookies, under normal circumstances, are sent to a web site when you revisit a domain or site that previously sent you a cookie. The problem is in how JavaScript determines what cookie it should access. It becomes trivial then to resubmit the resultant cookie back to any site at all. Secure cookies have been, short of client side digital certificates, the best way of securing sessions, and are used by sites that wish to use to cookies to manage a login session, while ensuring that the cookie is never written to disk. While some functionality may be lost, most sites will continue to operate properly.
Many secure sites implement a logoff mechanism that clears the cookie they set.
Doing so will ensure that no other site can steal the cookie and access your data. The following exploits demonstrate the operation of the exploit. We do NOT keep the cookies from any data entered.