HTTP Codes and HeadersCookies: the Set-Cookie header
A cookie is set by one response header and sent back by the browser on later requests. The attributes decide where it travels and who can read it.
A real response
GET /cookie HTTP/1.1
Host: example.com
HTTP/1.1 200 OK
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/html; charset=utf-8
Set-Cookie: sid=abc123; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax
Content-Length: 9
<p>hi</p>The browser stores sid=abc123. On later requests to this site it sends Cookie: sid=abc123.
The attributes
| Attribute | What it does |
|---|---|
Max-Age=3600 | Keep the cookie for 3,600 seconds. Without Max-Age or Expires it is a session cookie, removed when the browser closes |
Path=/ | The cookie is sent for every address on the site |
Secure | The browser sends the cookie only over a secure channel (https) |
HttpOnly | Scripts on the page cannot read it through document.cookie |
SameSite=Lax | The cookie is not sent with most requests that start on another site, but is sent when a visitor clicks a link to your site |
SameSite=Strict | Sent only for requests that start on your own site |
SameSite=None | Sent in all contexts. Browsers require Secure with it |
Domain=example.com | Also share the cookie with subdomains. Leave it out to keep the cookie to the exact host |
The definitions of Secure and HttpOnly come from the cookie specification (the IETF draft that updates RFC 6265), which we read on 14 November 2026.
Good defaults for a login cookie
Secure, so it never travels over plain http.HttpOnly, so a script injected into a page cannot steal it.SameSite=Lax(orStrictfor very sensitive actions).- A reasonable
Max-Age, with a way to log out that deletes it.
Paste your response into the header checker to see these checks: it flags cookies without the three attributes. It is advice, not a security audit.
Why a cookie may not be saved
- The attribute
Secureon a page loaded over http. SameSite=NonewithoutSecure.- A domain attribute that does not match the host.
- The cookie is too large, or the browser blocks third-party cookies.
How big can a cookie be?
Browsers limit the size of each cookie and the number per site. Large cookies also cause 431 errors. Keep session data on the server and put only an identifier in the cookie.
Is a cookie banner needed?
That is a legal question that depends on your country and on what the cookie is for. This site gives no legal advice.
Sources
- The cookie specification, IETF draft-ietf-httpbis-rfc6265bis (httpwg.org), sections on Secure, HttpOnly and SameSite, read 14 November 2026
Read on 14 November 2026.
This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.