See https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#define_the_lifetime_of_a_cookie

Only sent over HTTPS (except on localhost).

Makes the cookie inaccessible to JavaScript.

This controls if cookies should be restricted to being first-party (ie loading an image on a 3rd party site). See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite