Set-Cookie Header: Syntax and Examples

How Set-Cookie works

Each cookie needs its own Set-Cookie header; they can’t be combined with commas like other headers. A cookie without Expires or Max-Age is a session cookie, deleted when the browser session ends. For session IDs, use Secure; HttpOnly; SameSite=Lax (or Strict) at minimum.

Directives

Value	Meaning
`Max-Age=<seconds> / Expires=<date>`	Lifetime. Max-Age wins if both are present. Max-Age=0 deletes the cookie.
`Secure`	Only sent over HTTPS.
`HttpOnly`	Hidden from JavaScript (document.cookie), which limits damage from XSS.
`SameSite=Lax`	Sent on top-level navigation from other sites, not on cross-site subrequests. Chrome’s default when SameSite is missing.
`SameSite=Strict`	Never sent on requests started by another site, even link clicks.
`SameSite=None`	Sent on cross-site requests; requires Secure.
`Domain=example.com`	Also send to subdomains. Without it, only the exact host gets the cookie.
`Path=/`	Only send for paths under this one.

Examples

A session cookie

Set-Cookie: session=4f2a9c; Path=/; Secure; HttpOnly; SameSite=Lax

Delete a cookie

Set-Cookie: session=; Path=/; Max-Age=0

Locked to one host, HTTPS only

Set-Cookie: __Host-id=1; Path=/; Secure; HttpOnly; SameSite=Strict

Common mistakes

To delete a cookie, send the same name, Path and Domain it was set with; otherwise the browser treats it as a different cookie.
The __Host- prefix makes the browser enforce Secure, Path=/ and no Domain, so subdomains can’t overwrite the cookie.

Check it

curl -sI https://example.com | grep -i '^set-cookie:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

Cookie: sends the browser’s stored cookies for this site back to the server.
Access-Control-Allow-Credentials: allows a cross-origin request made with cookies or HTTP authentication to read the response.
Strict-Transport-Security: tells browsers to use only HTTPS for this site, for a given time (HSTS).

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Set-Cookie header do?

The Set-Cookie response header stores a cookie in the browser, with attributes that control its lifetime, scope and security. Each cookie needs its own Set-Cookie header; they can’t be combined with commas like other headers. A cookie without Expires or Max-Age is a session cookie, deleted when the browser session ends. For session IDs, use Secure; HttpOnly; SameSite=Lax (or Strict) at minimum.

How do I see the Set-Cookie header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.