domain
Controls the domain the cookie is associated with; allows you to assign cookies to a specific subdomain
path
Controls the path to which a cookie applies
maxAge
Specifies in milliseconds how long the client should keep the cookie before deleting it
secure
Specifies that this cookie will be sent only over a secure (HTTPS) connection
httpOnly
Cookie will be modified only by the server. It cannot be modified by JavaScript. Helps prevent XSS attacks
signed
Sign this cookie, making it available to res.signedCookies instead of res.cookies. Cookies that have been tampered with will be rejected by the server and cookie will be reset to original value