A session/auth cookie without httpOnly is readable by XSS; without secure it is sent over plaintext HTTP.
Set httpOnly, secure and sameSite flags on session/auth cookies (res.cookie(name, val, { httpOnly: true, secure: true })).