diff --git a/max/app.py b/max/app.py
index 24ae8b7..f59464e 100644
--- a/max/app.py
+++ b/max/app.py
@@ -47,8 +47,9 @@ def main():
         SECRET_KEY=(
             "123456" if app.debug else base64.b64encode(os.urandom(64)).decode("utf-8")
         ),
+        SESSION_COOKIE_NAME="session" if app.debug else "__Host-session",
         SESSION_COOKIE_SECURE=not app.debug,
-        SESSION_COOKIE_SAMESITE=False,
+        SESSION_COOKIE_SAMESITE="Lax",
     )
     add_middleware_stack(
         app,
diff --git a/max/sessions.py b/max/sessions.py
index ac30b1d..1e02157 100644
--- a/max/sessions.py
+++ b/max/sessions.py
@@ -139,19 +139,27 @@ class SessionInterface(FlaskSessionInterface):
             return self.make_session_object()
         return session
 
+    def get_cookie_attributes(self, app):
+        # Attributes for setting and deleting the cookie must match, because
+        # browsers ignore a deletion of a __Host- cookie without Secure and Path.
+        return dict(
+            domain=self.get_cookie_domain(app),
+            path=self.get_cookie_path(app),
+            secure=self.get_cookie_secure(app),
+            httponly=self.get_cookie_httponly(app),
+            samesite=self.get_cookie_samesite(app),
+        )
+
     def save_session(self, app, session, response):
-        domain = self.get_cookie_domain(app)
-        path = self.get_cookie_path(app)
         cookie_name = self.get_cookie_name(app)
+        cookie_attributes = self.get_cookie_attributes(app)
         if session.is_empty():
             if session.modified:
                 del session_storage[session.id]
             # Only send the deletion header if the client sent a cookie
             if cookie_name in request.cookies:
-                response.delete_cookie(cookie_name, domain=domain, path=path)
+                response.delete_cookie(cookie_name, **cookie_attributes)
         else:
-            httponly = self.get_cookie_httponly(app)
-            secure = self.get_cookie_secure(app)
             expires = self.get_expiration_time(app, session)
             session.last_seen = time.monotonic()
             if session.created_at is None:
@@ -170,11 +178,5 @@ class SessionInterface(FlaskSessionInterface):
                 self._get_signer(app).sign(want_bytes(session.id)).decode("utf-8")
             )
             response.set_cookie(
-                cookie_name,
-                session_id,
-                expires=expires,
-                httponly=httponly,
-                domain=domain,
-                path=path,
-                secure=secure,
+                cookie_name, session_id, expires=expires, **cookie_attributes
             )