A session cookie is a bearer token that a browser attaches to requests for you. Everything that makes it convenient is also what makes its attributes matter, and each of the three closes a different door.
HttpOnly stops script on the page from reading it, which is what turns a cross-site scripting defect into a session theft. Secure stops the browser sending it over plain HTTP. SameSite stops it being attached to requests that another site started — which is most of what makes cross-site request forgery work.
POST /sessionLook at the Set-Cookie header on each. The bodies are identical.
None of the three are on by default, in any framework worth naming, and this engine does not add them either — a framework that quietly set HttpOnly would be lying about what the handler in front of you does.
So the absence is the defect, the fix is one options object, and the whole exercise is whether you noticed. That is a fair description of most of this track.