Secure Defaults for Cookies

Which cookie attributes matter for security (Secure, HttpOnly, SameSite, Domain/Path), and what are sane defaults for a session cookie?

Answers use simple, clear English.