Cookies · Response header
Set-Cookie
Sends a cookie to be stored by the client.
What is Set-Cookie?
Set-Cookie is how servers create browser cookies. Attributes control lifetime (Max-Age/Expires), scope (Domain/Path), and safety (Secure, HttpOnly, SameSite).
Typical usage
Set on responses that establish or update session state.
Examples
Secure session cookie
Set-Cookie: session=abc; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=LaxCross-site cookie (embedded auth)
Set-Cookie: token=xyz; Path=/; Secure; SameSite=NoneCommon gotchas
SameSite=None requires Secure. Missing Secure with SameSite=None causes the browser to silently reject the cookie.
Also known as
Also commonly written as: set-cookie header · set cookie header · http set-cookie · samesite cookie · httponly cookie · secure cookie flag · Set-Cookie ヘッダ. These variants — including plural forms, unhyphenated spellings, and Japanese (ヘッダ) — all refer to the same Set-Cookie HTTP header.
Specification
RFC 6265bis
Frequently asked questions
What is the Set-Cookie HTTP header?
Set-Cookie is how servers create browser cookies. Attributes control lifetime (Max-Age/Expires), scope (Domain/Path), and safety (Secure, HttpOnly, SameSite).
Is Set-Cookie a request or response header?
Set-Cookie is a response header — the server sends it to the client. Set on responses that establish or update session state.
What does a Set-Cookie header look like?
A typical Set-Cookie header looks like: Set-Cookie: session=abc; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax (Secure session cookie).
What are common mistakes with Set-Cookie?
SameSite=None requires Secure. Missing Secure with SameSite=None causes the browser to silently reject the cookie.