Name and value
The name identifies the setting; the value carries its data. With theme=dark, your application decides what dark means. An arbitrary change may be ignored.
Domain and path
Domain controls which hosts receive a cookie; Path narrows matching request paths. A host-only cookie is more restricted than one scoped to a parent domain and its subdomains. Check both when debugging duplicate names.
Expiration and session cookies
Persistent cookies have an expiry. Session cookies do not, but browsers can preserve them during session restoration. A stored cookie does not prove its server-side session is valid.
Secure and HttpOnly
Secure
Restricts transmission to secure connections, with exceptions for localhost. It does not encrypt stored values.
HttpOnly
Blocks page JavaScript access through APIs such as document.cookie. Developer tools can still display the cookie.
SameSite
Strict restricts cross-site sending most. Lax allows some top-level navigations. None permits cross-site use and requires Secure. Other browser privacy restrictions can still apply.
Compare a working example with the failing one. Adjust one field, reload and inspect the request. Keep notes to reproduce the difference.
Put the fields to work
Try the editing walkthrough or save a known setup with the import and export guide. Consult current browser documentation for partitioned cookies and browser-specific behavior.