Cookies · Response header

Set-Cookie

Sends a cookie to be stored by the client.

What is Set-Cookie?

Set-Cookie is how servers create browser cookies. Attributes control lifetime (Max-Age/Expires), scope (Domain/Path), and safety (Secure, HttpOnly, SameSite).

Typical usage

Set on responses that establish or update session state.

Examples

Secure session cookie

Set-Cookie: session=abc; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax

Cross-site cookie (embedded auth)

Set-Cookie: token=xyz; Path=/; Secure; SameSite=None

Common gotchas

SameSite=None requires Secure. Missing Secure with SameSite=None causes the browser to silently reject the cookie.

Specification

RFC 6265bis

Related headers

All cookies stored by the browser for this origin.