How to enable host only flag for a session cookie?

That flag cannot be explicitly set or unset. It’s derived from the cookie domain value (if set). You can customize the domain of the session cookie via the :domain option: Plug.Session — Plug v1.14.0