HTTPOnly cookie possible?

So, i tried to use the authentication and it worked pretty great for the most part. But when I set httpOnly for the cookies, it will not be set. What would be the reason for that? I would unterstand, that the client does not have access to that cookie, but not sure if we would need to have access anyway? I'm just worried about potential security risks.

When I try this, it works:

cookie: {
    maxAge: 14 * 24 * 60 * 60,
    secure: process.env.NODE_ENV === 'production',
    sameSite: true
}

But when I add httpOnly, then the cookie is not set. Does not work:

cookie: {
    httpOnly: true,
    maxAge: 14 * 24 * 60 * 60,
    secure: process.env.NODE_ENV === 'production',
    sameSite: true
}

I also tried various other things, like settings sameSite to lax etc. Everything works, until I set httpOnly to true.

Start by reproducing the authentication setup with the working cookie configuration, then add httpOnly as shown in the issue and inspect the resulting cookie behavior. Trace the module's cookie-setting entry point to determine whether the option is being passed through or rejected. Done means the cause is documented and the intended httpOnly configuration works or produces a clear error.