Set-Cookie attributes: SameSite, Secure, HttpOnly, Max-Age

Attributes on a Set-Cookie header control when the browser sends the cookie back. SameSite decides whether it goes with cross-site requests, Secure limits it to HTTPS, HttpOnly hides it from document.cookie, and Max-Age or Expires set how long it lives. A session cookie for a normal web app should be Secure; HttpOnly; SameSite=Lax.

See the header a server sends

node -e '
const http = require("http");
const server = http.createServer((req, res) => {
  res.setHeader("Set-Cookie", [
    "session=abc123; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax",
    "prefs=dark; Path=/; Max-Age=31536000; SameSite=Strict",
  ]);
  res.end("ok");
}).listen(0, () => {
  http.get({ port: server.address().port }, (res) => {
    for (const c of res.headers["set-cookie"]) console.log("Set-Cookie:", c);
    server.close();
  });
});'

Set-Cookie: session=abc123; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax
Set-Cookie: prefs=dark; Path=/; Max-Age=31536000; SameSite=Strict

Attributes

Common problems

• A cookie with SameSite=None but without Secure is rejected by current browsers.
• Cross-site iframes and APIs on another site need SameSite=None; Secure, and third-party cookie restrictions may still block them.
• __Host- prefixed names (for example __Host-session) require Secure, Path=/ and no Domain, which prevents subdomains from overwriting them.