.tip

Each of the three attributes closes off a class of attack. HttpOnly stops scripts reading the cookie, Secure keeps it off plain HTTP, and SameSite=Lax stops it being sent on cross-site POSTs, which covers most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while you're logged in, so Lax is the default worth keeping.