Set-Cookie

You’re reading the English version of this content since no translation exists yet for this locale. Help us translate this article!

The Set-Cookie HTTP response header is used to send cookies from the server to the user agent, so the user agent can send them back to the server later.

For more information, see the guide on HTTP cookies.

Header type Response header
Forbidden header name no

Syntax

Set-Cookie: <cookie-name>=<cookie-value> 
Set-Cookie: <cookie-name>=<cookie-value>; Expires=<date>
Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<non-zero-digit>
Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>
Set-Cookie: <cookie-name>=<cookie-value>; Path=<path-value>
Set-Cookie: <cookie-name>=<cookie-value>; Secure
Set-Cookie: <cookie-name>=<cookie-value>; HttpOnly

Set-Cookie: <cookie-name>=<cookie-value>; SameSite=Strict
Set-Cookie: <cookie-name>=<cookie-value>; SameSite=Lax
Set-Cookie: <cookie-name>=<cookie-value>; SameSite=None  

// Multiple directives are also possible, for example:
Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>; Secure; HttpOnly

Directives

<cookie-name>=<cookie-value>
A cookie begins with a name-value pair:
  • A <cookie-name> can be any US-ASCII characters, except control characters, spaces, or tabs. It also must not contain a separator character like the following: ( ) < > @ , ; : \ " / [ ] ? = { }.
  • A <cookie-value> can optionally be wrapped in double quotes and include any US-ASCII characters excluding control characters. Whitespace, double quotes, comma, semicolon, and backslash are allowed. Encoding: Many implementations perform URL encoding on cookie values, however it is not required per the RFC specification. It does help satisfying the requirements about which characters are allowed for <cookie-value> though.
  • __Secure- prefix : Cookies names starting with __Secure- (dash is part of the prefix) must be set with the secure flag from a secure page (HTTPS).
  • __Host- prefix : Cookies with names starting with __Host- must be set with the secure flag, must be from a secure page (HTTPS), must not have a domain specified (and therefore aren't sent to subdomains) and the path must be /.
Expires=<date> Optional

The maximum lifetime of the cookie as an HTTP-date timestamp. See Date for the required formatting.

If unspecified, the cookie becomes a session cookie. A session finishes when the client shuts down, and session cookies will be removed.

Warning: Many web browsers have a session restore feature that will save all tabs and restore them next time the browser is used. Session cookies will also be restored, as if the browser was never closed.

When an Expires date is set, the deadline is relative to the client the cookie is being set on, not the server.

Max-Age=<number> Optional
Number of seconds until the cookie expires. A zero or negative number will expire the cookie immediately. If both Expires and Max-Age are set, Max-Age has precedence.
Domain=<domain-value> Optional
Hosts to where the cookie will be sent.
  • If omitted, defaults to the host of the current document URL, not including subdomains.
  • Contrary to earlier specifications, leading dots in domain names (.example.com) are ignored.
  • If a domain is specified, subdomains are always included.
Path=<path-value> Optional
A path that must exist in the requested URL, or the browser won't send the Cookie header.
The forward slash (/) character is interpreted as a directory separator, and subdirectories will be matched as well: for Path=/docs, /docs, /docs/Web/, and /docs/Web/HTTP will all match.
Secure Optional
A secure cookie is only sent to the server when a request is made with the https: scheme. (However, confidential information should never be stored in HTTP Cookies, as the entire mechanism is inherently insecure and doesn't encrypt any information.)

Note: Insecure sites (http:) can't set cookies with the "secure" directive anymore (in Chrome 52+ and Firefox 52+).

HttpOnly Optional
Forbids JavaScript from accessing the cookie. For example, through the Document.cookie property, the XMLHttpRequest API, or the Request API. This mitigates attacks against cross-site scripting (XSS).
SameSite=<samesite-value> Optional
  • Strict
  • Lax
  • None

Asserts that a cookie must not be sent with cross-origin requests, providing some protection against cross-site request forgery attacks (CSRF).

Examples

Session cookies are removed when the client shuts down. Cookies are session cookies if they don't specify the Expires or Max-Age directives.

Set-Cookie: sessionId=38afes7a8

Instead of expiring when the client is closed, permanent cookies expire at a specific date (Expires) or after a specific length of time (Max-Age).

Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT
Set-Cookie: id=a3fWa; Max-Age=2592000

Invalid domains

A cookie for a domain that does not include the server that set it should be rejected by the user agent.

The following cookie will be rejected if set by a server hosted on originalcompany.com:

Set-Cookie: qwerty=219ffwef9w0f; Domain=somecompany.co.uk

Cookies names prefixed with __Secure- or __Host- can be used only if they are set with the secure directive from a secure (HTTPS) origin.

In addition, cookies with the __Host- prefix must have a path of / (meaning any path at the host) and must not have a Domain attribute.

For clients that don't implement cookie prefixes, you cannot count on these additional assurances, and prefixed cookies will always be accepted.

// Both accepted when from a secure origin (HTTPS)
Set-Cookie: __Secure-ID=123; Secure; Domain=example.com
Set-Cookie: __Host-ID=123; Secure; Path=/

// Rejected due to missing Secure directive
Set-Cookie: __Secure-id=1

// Rejected due to the missing Path=/ directive
Set-Cookie: __Host-id=1; Secure

// Rejected due to setting a domain
Set-Cookie: __Host-id=1; Secure; Path=/; domain=example.com

Specifications

Specification Title
RFC 6265, section 4.1: Set-Cookie HTTP State Management Mechanism
draft-ietf-httpbis-rfc6265bis-02 Cookie Prefixes, Same-Site Cookies, and Strict Secure Cookies

Browser compatibility

Compatibility notes

  • Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the "secure" directive anymore.

See also