Set-Cookie

Stores a cookie in the browser, with rules for when it is sent back.

Explained

Examples

Example

Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

Watch out

Set HttpOnly so scripts cannot read session cookies, Secure so they only go over HTTPS, and SameSite to limit cross-site sending. Each cookie needs its own Set-Cookie line.

Defined in RFC 6265 §4.1.

Other common headers

Request

Response

Either side