Set-Cookie

Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax

What it does

Creates or updates a cookie. The attributes are the security model: HttpOnly, Secure, SameSite.

In practice

HttpOnly keeps scripts from reading it (what stops XSS stealing sessions). Secure keeps it off plain HTTP — and silently prevents it being stored AT ALL on http:// pages, a classic localhost confusion. SameSite=Lax stops cross-site POSTs from carrying it (CSRF) while still allowing top-level navigation; Strict breaks arriving-by-link while signed in; None requires Secure and re-enables cross-site sending for embedded contexts. One more: a cookie can only be deleted with the same Path and Domain it was set with.

← All headers