SetCookieHeader

SetCookieheader, commonly known as the Set-Cookie header, is an HTTP response header used by servers to set cookies in the user agent. Each SetCookieheader entry defines a single cookie with a name and value and may include attributes that control its scope and behavior.

Syntax and attributes: Set-Cookie: <name>=<value>[; Expires=<date>][; Max-Age=<seconds>][; Domain=<domain>][; Path=<path>][; Secure][; HttpOnly][; SameSite=<Lax|Strict|None>]. Expires is deprecated in favor of Max-Age. Domain restricts the host for which the cookie is sent; Path restricts the path. Secure requires a secure channel (HTTPS). HttpOnly prevents access by client-side scripts. SameSite helps mitigate cross-site request forgery; values include Strict, Lax, None. When SameSite=None, the Secure attribute is required in modern browsers.

Behavior and scope: The user agent stores cookies received via SetCookieheader and includes them in subsequent requests to matching origins. If multiple cookies apply to a request, they are sent in a single Cookie header as a semicolon-separated list. Cookies are scoped by domain and path, and are subject to per-origin storage and size limits, which vary by user agent.

Security and best practices: Avoid placing highly sensitive data in cookies. Use HttpOnly for session cookies, Secure for cookies that should traverse only over TLS, and SameSite appropriately to reduce cross-site request risks. Be mindful of cookie size and total number when designing authentication and tracking mechanisms.