When using BrowserKit to navigate a site, cookies are never marked as secure even if they have been sent with the correct headers from the server.

The reason appears to be that the Cookie class discards the "secure" flag unless the URL is passed into Cookie::fromString

  // Ignore the secure flag if the original URI is not given or is not HTTPS
  if (!$url || !isset($urlParts['scheme']) || 'https' != $urlParts['scheme']) {
    continue;
  }

However, the Client only passes the response object, not the URL, when updating the cookiejar.