Tres flags deciden si se puede robar una sesión.

Set-Cookie: session=abc123; Path=/; Max-Age=604800;
  Secure;
  HttpOnly;
  SameSite=Lax

# Secure   -> https only
# HttpOnly -> invisible to document.cookie
# SameSite -> not sent on cross-site requests

# Note: SameSite=None REQUIRES Secure, and browsers drop the cookie
# entirely if you set None without it. That silent drop is a common
# cause of "my login works locally and not in production".

import { cookies } from "next/headers";

(await cookies()).set("session", token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
  path: "/",
  maxAge: 60 * 60 * 24 * 7,
});

// Behind a proxy or load balancer, "secure" cookies are dropped
// unless Express is told to trust the forwarded protocol. Missing
// this is why the flag silently does nothing in production.
app.set("trust proxy", 1);

res.cookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
  maxAge: 1000 * 60 * 60 * 24 * 7,
});

// Hono
import { setCookie } from "hono/cookie";

setCookie(c, "session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "Lax",
  path: "/",
  maxAge: 60 * 60 * 24 * 7,
});

// Fastify (@fastify/cookie)
reply.setCookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
  path: "/",
});