Cookie flags: HttpOnly, Secure, SameSite
Three attributes decide whether your cookie is sent at all. Here's what each one does, and why yours is missing.
Security
2 articles tagged this.
Sessions vs JWT: which one, and why
One is a pointer, the other is a copy. Almost every argument about them comes from missing that one line.