A practical guide to cookie attributes for engineers who keep getting logged out of embedded widgets or failing security reviews: what SameSite, Secure, HttpOnly, __Host- and Partitioned really do, with tested defaults for common setups.
Every POST to our Django admin returned 403 after we moved TLS termination to a Traefik ingress. Django compared the browser's https Origin with a request it believed was plain http. Two settings fixed it without weakening CSRF.
Login and checkout forms started failing with 419 Page Expired the day we put two Laravel nodes behind a TLS-terminating load balancer. Untrusted proxy headers, secure cookies and file sessions on each node combined into one confusing error.