How to change WordPress cookies to be session-only

The wp_generate_auth_cookie() function is a pluggable function, meaning you can define a function with the same name in a plugin and your version will be used instead of the WordPress core function.

The number of pluggable functions is limited, however. If you want a broad solution that works for all cookies, your lower-level Lua approach will be a better option.