What you need to know
HttpOnly prevents browser JavaScript from reading a cookie, Secure restricts it to HTTPS, and SameSite controls when a browser sends it across sites. Each attribute addresses a different risk.
How to apply it
Use Secure in production, HttpOnly for session cookies, and choose SameSite based on required sign-in and callback flows. Set a narrow path and reasonable expiration where possible.
Common mistake to avoid
Do not disable protections to fix a broken auth flow without understanding the provider's callback requirements. Test the intended cross-site behavior.