Session Cookies

The server remembers, the cookie only identifies. A session id in a cookie, and the actual state stored server-side.

The advantages are real: you can revoke a session instantly by deleting it, the cookie carries nothing sensitive, and the browser sends it automatically. Django works this way by default and for most applications it is the right answer.

The flags that make a cookie safe, and each prevents a specific attack.

HttpOnly means JavaScript cannot read it, so a cross-site scripting bug does not become a stolen session.

Secure means it is only sent over HTTPS, so it is not readable on a shared network.

SameSite=Lax or Strict means it is not sent on cross-site requests, which is most of what CSRF protection is about.

All three, always. There is no case in a normal web application where omitting one of them is the right call.