OptionaldomainCookie domain.
OptionalexpiresAbsolute expiry date.
OptionalhttpPrevent client-side JS access.
OptionalmaxMax lifetime in seconds.
OptionalpathCookie path. Omitted by default (the browser uses the request path).
OptionalsameSameSite attribute.
OptionalsecureHTTPS only.
Options for the
Set-Cookieheader, controlling cookie lifetime, scope, and security attributes.