In WordPress (and other PHP CMSs), to secure session cookies, you would apply the following to your wp-config.php file.
@ini_set('session.cookie_httponly', true);
@ini_set('session.cookie_secure', true);
@ini_set('session.use_only_cookies', true);
However, this isn't how you do it in Statamic. Instead, it's as simple as applying the following to your .env
file.
SESSION_SECURE=true