Set-Cookie
ResponseActiveThe Set-Cookie header instructs the browser to store a cookie. Security attributes are critical: HttpOnly prevents JavaScript access (XSS mitigation), Secure requires HTTPS, SameSite controls cross-site submission (CSRF mitigation). The __Host- and __Secure- prefixes provide additional security guarantees.
Set-Cookie: <name>=<value>[; <attributes>]
Description
Set-Cookie creates or updates a browser cookie. Each attribute affects security and scope: Domain sets which hosts receive the cookie, Path restricts the URL path, Expires/Max-Age controls lifetime, Secure limits to HTTPS, HttpOnly blocks JavaScript, and SameSite controls cross-origin sending behavior.
Directives
| Directive | Description |
|---|---|
| HttpOnly | Prevents JavaScript access. Mitigates XSS token theft. |
| Secure | Only send over HTTPS connections. |
| SameSite=Strict | Never send on cross-site requests. Strongest CSRF protection. |
| SameSite=Lax | Send on top-level navigation only. Default in modern browsers. |
| SameSite=None | Always send. Requires Secure attribute. |
| Max-Age=<seconds> | Cookie lifetime in seconds. 0 or negative deletes the cookie. |
| __Host- prefix | Requires Secure, no Domain, Path=/. Strongest binding. |
Examples
Secure session cookie
http
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict; Path=/With expiry
http
Set-Cookie: __Host-token=xyz; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400