---
source_url: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=openai"
title: "Set-Cookie header - HTTP | MDN"
mirrored_at: 2026-08-04T12:31:59.513Z
host: developer.mozilla.org
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie__q__utm_source_openai"
---

> **Original source:** https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=openai

## [Syntax](#syntax)

http

```
Set-Cookie: <cookie-name>=<cookie-value>
Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>
Set-Cookie: <cookie-name>=<cookie-value>; Expires=<date>
Set-Cookie: <cookie-name>=<cookie-value>; HttpOnly
Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<number>
Set-Cookie: <cookie-name>=<cookie-value>; Partitioned
Set-Cookie: <cookie-name>=<cookie-value>; Path=<path-value>
Set-Cookie: <cookie-name>=<cookie-value>; Secure

Set-Cookie: <cookie-name>=<cookie-value>; SameSite=Strict
Set-Cookie: <cookie-name>=<cookie-value>; SameSite=Lax
Set-Cookie: <cookie-name>=<cookie-value>; SameSite=None; Secure

// Multiple attributes are also possible, for example:
Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>; Secure; HttpOnly
```

## [Attributes](#attributes)

[`<cookie-name>=<cookie-value>`](#cookie-namecookie-value)

Defines the cookie name and its value. A cookie definition begins with a name-value pair.

A `<cookie-name>` can contain any US-ASCII characters except for control characters ([ASCII](https://developer.mozilla.org/en-US/docs/Glossary/ASCII) characters 0 up to 31 and ASCII character 127) or separator characters (space, tab and the characters: `( ) < > @ , ; : \ " / [ ] ? = { }`)

A `<cookie-value>` can optionally be wrapped in double quotes and include any US-ASCII character excluding control characters (ASCII characters 0 up to 31 and ASCII character 127), [Whitespace](https://developer.mozilla.org/en-US/docs/Glossary/Whitespace), double quotes, commas, semicolons, and backslashes.

**Encoding**: Many implementations perform [percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding) on cookie values. However, this is not required by the RFC specification. The percent-encoding does help to satisfy the requirements of the characters allowed for `<cookie-value>`.

**Note:** Some cookie names contain prefixes that impose specific restrictions on the cookie's attributes in supporting user-agents. See [Cookie prefixes](#cookie_prefixes) for more information.

[`Domain=<domain-value>` Optional](#domaindomain-value)

Defines the host to which the cookie will be sent.

Only the current domain can be set as the value, or a domain of a higher order, unless it is a public suffix. Setting the domain will make the cookie available to it, as well as to all its subdomains.

If omitted, the cookie is returned only to the host that sent them (i.e., it becomes a "host-only cookie"). This is more restrictive than setting the host name, as the cookie is not made available to subdomains of the host.

Contrary to earlier specifications, leading dots in domain names (`.example.com`) are ignored.

Multiple host/domain values are _not_ allowed, but if a domain _is_ specified, then subdomains are always included.

[`Expires=<date>` Optional](#expiresdate)

Indicates the maximum lifetime of the cookie as an HTTP-date timestamp. See [`Date`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Date) for the required formatting.

If unspecified, the cookie becomes a **session cookie**. A session finishes when the client shuts down, after which the session cookie is removed.

**Warning:** Many web browsers have a _session restore_ feature that will save all tabs and restore them the next time the browser is used. Session cookies will also be restored, as if the browser was never closed.

The `Expires` attribute is set by the server with a value relative to its own internal clock, which may differ from that of the client browser. Firefox and Chromium-based browsers internally use an expiry (max-age) value that is adjusted to compensate for clock difference, storing and expiring cookies based on the time intended by the server. The adjustment for clock skew is calculated from the value of the [`DATE`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Date) header. Note that the specification explains how the attribute should be parsed, but does not indicate if/how the value should be corrected by the recipient.

[`HttpOnly` Optional](#httponly)

Forbids JavaScript from accessing the cookie, for example, through the [`Document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie) property. Note that a cookie that has been created with `HttpOnly` will still be sent with JavaScript-initiated requests, for example, when calling [`XMLHttpRequest.send()`](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/send) or [`fetch()`](https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch "fetch()"). This mitigates attacks against cross-site scripting ([XSS](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)).

[`Max-Age=<number>` Optional](#max-agenumber)

Indicates the number of seconds until the cookie expires. A zero or negative number will expire the cookie immediately. If both `Expires` and `Max-Age` are set, `Max-Age` has precedence.

[`Partitioned` Optional](#partitioned)

Indicates that the cookie should be stored using partitioned storage. Note that if this is set, the [`Secure` directive](#secure) must also be set. See [Cookies Having Independent Partitioned State (CHIPS)](https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Third-party_cookies/Partitioned_cookies) for more details.

[`Path=<path-value>` Optional](#pathpath-value)

Indicates the path that _must_ exist in the requested URL for the browser to send the `Cookie` header.

If omitted, this attribute defaults to the path component of the request URL. For example, if a cookie is set by a request to `https://example.com/docs/Web/HTTP/index.html`, the default path would be `/docs/Web/HTTP/`.

The forward slash (`/`) character is interpreted as a directory separator, and subdirectories are matched as well. For example, for `Path=/docs`,

-   the request paths `/docs`, `/docs/`, `/docs/Web/`, and `/docs/Web/HTTP` will all match.
-   the request paths `/`, `/docsets`, `/fr/docs` will not match.

**Note:** The `path` attribute lets you control what cookies the browser sends based on the different parts of a site. It is not intended as a security measure, and [does not protect](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie#security) against unauthorized reading of the cookie from a different path.

[`SameSite=<samesite-value>` Optional](#samesitesamesite-value)

Controls whether or not a cookie is sent with cross-site requests: that is, requests originating from a different [site](https://developer.mozilla.org/en-US/docs/Glossary/Site), including the scheme, from the site that set the cookie. This provides some protection against certain cross-site attacks, including [cross-site request forgery (CSRF)](https://developer.mozilla.org/en-US/docs/Glossary/CSRF) attacks.

The possible attribute values are:

[`Strict`](#strict)

Send the cookie only for requests originating from the same [site](https://developer.mozilla.org/en-US/docs/Glossary/Site) that set the cookie.

[`Lax`](#lax)

Send the cookie only for requests originating from the same [site](https://developer.mozilla.org/en-US/docs/Glossary/Site) that set the cookie, and for cross-site requests that meet both of the following criteria:

-   The request is a top-level navigation: this essentially means that the request causes the URL shown in the browser's address bar to change.
    
    -   This would exclude, for example, requests made using the [`fetch()`](https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch "fetch()") API, or requests for subresources from [`<img>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/img) or [`<script>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script) elements, or navigations inside [`<iframe>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe) elements.
        
    -   It would include requests made when the user clicks a link in the top-level browsing context from one site to another, or an assignment to [`document.location`](https://developer.mozilla.org/en-US/docs/Web/API/Document/location "document.location"), or a [`<form>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/form) submission.
        
-   The request uses a [safe](https://developer.mozilla.org/en-US/docs/Glossary/Safe/HTTP) method: in particular, this excludes [`POST`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST), [`PUT`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/PUT), and [`DELETE`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/DELETE).
    

Some browsers use `Lax` as the default value if `SameSite` is not specified: see [Browser compatibility](#browser_compatibility) for details.

**Note:** When `Lax` is applied as a default, a more permissive version is used. In this more permissive version, cookies are also included in [`POST`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST) requests, as long as they were set no more than two minutes before the request was made.

[`None`](#none)

Send the cookie with both cross-site and same-site requests. The `Secure` attribute must also be set when using this value.

[`Secure` Optional](#secure)

Indicates that the cookie is sent to the server only when a request is made with the `https:` scheme (except on localhost), and therefore, is more resistant to [man-in-the-middle](https://developer.mozilla.org/en-US/docs/Glossary/MitM) attacks.

**Note:** Do not assume that `Secure` prevents all access to sensitive information in cookies (session keys, login details, etc.). Cookies with this attribute can still be read/modified either with access to the client's hard disk or from JavaScript if the `HttpOnly` cookie attribute is not set.

Insecure sites (`http:`) cannot set cookies with the `Secure` attribute. The `https:` requirements are ignored when the `Secure` attribute is set by localhost.

## [Cookie prefixes](#cookie_prefixes)

Some cookie names contain prefixes that impose specific restrictions on the cookie's attributes in supporting user-agents. All cookie prefixes start with a double-underscore (`__`) and end in a dash (`-`). The following prefixes are defined:

-   **`__Secure-`**: Cookies with names starting with `__Secure-` must be set with the `Secure` attribute by a secure page (HTTPS).
-   **`__Host-`**: Cookies with names starting with `__Host-` must be set with the `Secure` attribute by a secure page (HTTPS). In addition, they must not have a `Domain` attribute specified, and the `Path` attribute must be set to `/`. This guarantees that such cookies are only sent to the host that set them, and not to any other host on the domain. It also guarantees that they are set host-wide and cannot be overridden on any path on that host. This combination yields a cookie that is as close as can be to treating the origin as a security boundary.
-   **`__Http-`**: Cookies with names starting with `__Http-` must be set with the `Secure` flag by a secure page (HTTPS) and in addition must have the `HttpOnly` attribute set to prove that they were set via the `Set-Cookie` header (they can't be set or modified via JavaScript features such as `Document.cookie` or the [Cookie Store API](https://developer.mozilla.org/en-US/docs/Web/API/Cookie_Store_API)).
-   **`__Host-Http-`**: Cookies with names starting with `__Host-Http-` must be set with the `Secure` flag by a secure page (HTTPS) and must have the `HttpOnly` attribute set to prove that they were set via the `Set-Cookie` header. In addition, they also have the same restrictions as `__Host-`\-prefixed cookies. This combination yields a cookie that is as close as can be to treating the origin as a security boundary while at the same time ensuring developers and server operators know that its scope is limited to HTTP requests.

**Warning:** You cannot count on these additional assurances on browsers that don't support cookie prefixes; in such cases, prefixed cookies will always be accepted.

## [Examples](#examples)

### [Session cookie](#session_cookie)

Session cookies are removed when the client shuts down. Cookies are session cookies if they do not specify the `Expires` or `Max-Age` attribute.

http

```
Set-Cookie: sessionId=38afes7a8
```

### [Permanent cookie](#permanent_cookie)

Permanent cookies are removed at a specific date (`Expires`) or after a specific length of time (`Max-Age`) and not when the client is closed.

http

```
Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT
```

http

```
Set-Cookie: id=a3fWa; Max-Age=2592000
```

### [Invalid domains](#invalid_domains)

A cookie for a domain that does not include the server that set it [should be rejected by the user agent](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.3 "External link (opens in new tab)").

The following cookie will be rejected if set by a server hosted on `original-company.com`:

http

```
Set-Cookie: qwerty=219ffwef9w0f; Domain=some-company.co.uk
```

A cookie for a subdomain of the serving domain will be rejected.

The following cookie will be rejected if set by a server hosted on `example.com`:

http

```
Set-Cookie: sessionId=e8bb43229de9; Domain=foo.example.com
```

### [Cookie prefixes](#cookie_prefixes_2)

Cookie names prefixed with `__Secure-` or `__Host-` can be used only if they are set with the `Secure` attribute from a secure (HTTPS) origin.

Cookie names prefixed with `__Http-` or `__Host-Http-` can be used only if they are set with the `Secure` attribute from a secure (HTTPS) origin and in addition must have the `HttpOnly` attribute set to prove that they were set via the `Set-Cookie` header and not on the client-side via JavaScript.

In addition, cookies with the `__Host-` or `__Host-Http-` prefix must have a path of `/` (meaning any path at the host) and must not have a `Domain` attribute.

http

```
// Both accepted when from a secure origin (HTTPS)
Set-Cookie: __Secure-ID=123; Secure; Domain=example.com
Set-Cookie: __Host-ID=123; Secure; Path=/

// Rejected due to missing Secure attribute
Set-Cookie: __Secure-id=1

// Rejected due to the missing Path=/ attribute
Set-Cookie: __Host-id=1; Secure

// Rejected due to setting a Domain
Set-Cookie: __Host-id=1; Secure; Path=/; Domain=example.com

// Only settable via Set-Cookie
Set-Cookie: __Http-ID=123; Secure; Domain=example.com
Set-Cookie: __Host-Http-ID=123; Secure; Path=/
```

### [Partitioned cookie](#partitioned_cookie)

http

```
Set-Cookie: __Host-example=34d8g; SameSite=None; Secure; Path=/; Partitioned;
```

**Note:** Partitioned cookies must be set with `Secure`. In addition, it is recommended to use a `__Host` or `__Host-Http-` prefix when setting partitioned cookies to make them bound to the hostname and not the registrable domain.

## [Specifications](#specifications)

Specification

[HTTP State Management Mechanism  
\# sane-set-cookie](https://httpwg.org/specs/rfc6265.html#sane-set-cookie)

## [Browser compatibility](#browser_compatibility)

## [See also](#see_also)

-   [HTTP cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies)
-   [`Cookie`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cookie)
-   [`Document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie)
-   [Samesite cookies explained](https://web.dev/articles/samesite-cookies-explained "External link (opens in new tab)") (web.dev blog)