How HTTP Works

Tools

Set-Cookie Builder

Is this Set-Cookie header valid, and will the browser keep it? Build one, or paste an existing header, and get it linted against RFC 6265bis with the prefix, SameSite, Secure and expiry rules explained.

Start from a preset

Generated header
Set-Cookie: session_id=abc123; Path=/; SameSite=Lax; Secure; HttpOnly
Add this to your response. See the Set-Cookie reference.
  • NoteThis cookie already meets the __Host- rules (Secure, Path=/, no Domain). Naming it __Host-session_id makes browsers enforce that and blocks subdomain cookie-tossing attacks.
Paste mode  Parse and lint an existing Set-Cookie header

Cookie

ref
Letters, digits and !#$%&'*+-.^_`|~ only. Use __Host- or __Secure- prefixes to make browsers enforce rules.
No spaces, quotes, commas, semicolons or backslashes. Anything else: percent-encode it.
ref
Leave empty for a host-only cookie (safest). Setting it exposes the cookie to every subdomain.
ref
URL prefix the cookie is sent for. Must start with /.

Attributes

ref
Lifetime from now. 0 or negative deletes the cookie. Chrome caps at 400 days.
ref
Absolute expiry, entered in your local time and sent as GMT. Max-Age wins if both are set.
ref
Chromium only.
Cookie name, value, domain, and path are never included.

What the browser will do

  • Sets a cookie named session_id with value abc123.
  • Session cookie: kept until the browser session ends (browsers that restore sessions may keep it longer).
  • HttpOnly: page scripts cannot read it, which limits what an XSS bug can steal.
  • Secure: only sent over HTTPS.
  • SameSite=Lax: sent on same-site requests and on top-level GET navigations from other sites, not on cross-site subrequests or form POSTs.
  • Host-only: sent to exactly the host that set it.

Set it from your server

res.cookie('session_id', 'abc123', { path: '/', sameSite: 'lax', secure: true, httpOnly: true, })

Cookie Reference

Browse all cookie attributes: Secure, HttpOnly, SameSite, Max-Age, Expires, Domain, Path. See also the Cookie Security guide and Set-Cookie header reference.

Browse /search