Cookie attributes — Secure, HttpOnly, SameSite
Every cookie should be Secure, HttpOnly where possible, and have an explicit SameSite. Use __Host- and __Secure- prefixes for session cookies.
draft-ietf-httpbis-rfc6265bis — Cookies: HTTP State Management Mechanism