NextAuth manages its authentication cookies and CSRF protections for built-in flows. Do not copy session cookies into localStorage or JavaScript. In production use HTTPS and secure cookie defaults. Cookie behavior depends on host, protocol, domain, SameSite, and Secure settings; customize only when you understand the implications.