Set-Cookie
Transfers session cookies from server to client with security flags controlling JavaScript access, cross-site transmission, and SSL encryption.
session_id=xyz; Secure; HttpOnly; SameSite=Lax; Path=/Production Server Implementation
proxy_cookie_flags ~ nosecure samesite=lax httponly;Directives & Syntax Breakdown
Prevents client-side scripts (document.cookie) from accessing the cookie, blocking XSS session hijacking.
Forces the cookie to only be transmitted over encrypted HTTPS connections.
Protects against Cross-Site Request Forgery (CSRF) by withholding cookie on cross-site requests.
Maximum CSRF protection: never sends cookie on any third-party link navigation.
Common Security Hazards & Pitfalls
- •Omitting HttpOnly allows any minor XSS vulnerability to compromise the entire user session.
- •SameSite=None MUST be accompanied by the "Secure" flag, otherwise modern browsers reject the cookie.
Set-Cookie - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
The browser may transmit the session cookie in plaintext if the user accesses an HTTP URL, exposing the session to Wi-Fi eavesdroppers.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.