Which fields in cookies are responsible for security?

• Secure: Indicates that the cookie will only be sent over a secure HTTPS connection.
• HttpOnly: Prevents access to the cookie from client-side scripts (e.g., JavaScript), protecting against XSS attacks.
• SameSite: Controls whether the cookie is sent with cross-site requests, helping to reduce CSRF attack risks. It can have values Strict, Lax, or None.
• __Host- and __Secure- prefixes: Indicate additional restrictions regarding Scope (path and domain) and require Secure for cookies respectively.

// Example of setting a cookie with security flags
document.cookie = "username=john; Secure; HttpOnly; SameSite=Lax";