Why doesn't express-session see httpOnly: false in config?

Question

Sessions

Why doesn't express-session see httpOnly=false and store the session with httpOnly= true so that any cookie from the browser via js is not retrieved?
Session config:

app.use(
  session({
    secret: process.env.SECRET_KEY,
    resave: false,
    httpOnly: false,
    saveUninitialized: false,
    store: new MongoStore({ url: process.env.DB_CONNECTION })
  })
);

Answer 1

and so?

app.use(
  session({
    secret: process.env.SECRET_KEY,
    resave: false,
    cookie: { httpOnly: false },
    saveUninitialized: false,
    store: new MongoStore({ url: process.env.DB_CONNECTION })
  })
);