Revision 1129973 of Set-Cookie

<div>{{HTTPSidebar}}</div>

<p>The <strong><code>Set-Cookie</code></strong> HTTP response header is used to send cookies from the server to the user agent.</p>

<p>For more information, see the guide on <a href="/en-US/docs/Web/HTTP/Cookies">HTTP cookies</a>.</p>

<table class="properties">
 <tbody>
  <tr>
   <th scope="row">Header type</th>
   <td>{{Glossary("Response header")}}</td>
  </tr>
  <tr>
   <th scope="row">{{Glossary("Forbidden header name")}}</th>
   <td>no</td>
  </tr>
 </tbody>
</table>

<h2 id="Syntax">Syntax</h2>

<pre class="syntaxbox">
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt; 
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; Expires=&lt;date&gt;
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; Max-Age=&lt;non-zero-digit&gt;
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; Domain=&lt;domain-value&gt;
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; Path=&lt;path-value&gt;
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; Secure
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; HttpOnly

Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; SameSite=Strict
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; SameSite=Lax

// Multiple directives are also possible, for example:
Set-Cookie: &lt;cookie-name&gt;=&lt;cookie-value&gt;; Domain=&lt;domain-value&gt;; Secure; HttpOnly
</pre>

<h2 id="Directives">Directives</h2>

<dl>
 <dt><code>&lt;cookie-name&gt;=&lt;cookie-value&gt;</code></dt>
 <dd>A cookie begins with a name-value pair:
 <ul>
  <li>A <code>&lt;cookie-name&gt;</code> can be anything but control characters (CTLs) or spaces and tabs. It also must not contain a separator character like the following: ( ) &lt; &gt; @ , ; : \ " /&nbsp; [ ] ? = { }.</li>
  <li>A <code>&lt;cookie-value&gt;</code> can optionally be set in double quotes and any US-ASCII characters excluding CTLs, whitespace, double quotes, comma, semicolon, and backslash are allowed. <strong>Encoding</strong>: Many implementations perform URL encoding on cookie values, however it is not required per the RFC specification. It does help satisfying the requirements about which characters are allowed for &lt;cookie-value&gt; though.</li>
  <li><strong><code>__Secure-</code> prefix</strong>: Cookies with a name starting with<code> __Secure-</code> (dash is part of the prefix) must be set with the <code>secure</code> flag and must be from a secure page (HTTPS).</li>
  <li><strong><code>__Host-</code> prefix</strong>: Cookies with a name starting with <code>__Host-</code> must be set with the <code>secure</code> flag, must be from a secure page (HTTPS), must not have a domain specified (and therefore aren't send to subdomains) and the path must be "/".</li>
 </ul>
 </dd>
 <dt>Expires=&lt;date&gt; {{optional_inline}}</dt>
 <dd>
 <p>The maximum lifetime of the cookie as an HTTP-date timestamp. See {{HTTPHeader("Date")}} for the detailed format. If not specified, the cookie will have the lifetime of a <strong>session cookie. </strong>A session is finished when the client is shut down meaning that session cookies will get removed at that point. However, many web browsers have a feature&nbsp;called session restore that will save all your tabs and have them come back next time you use the browser. Cookies will also be present and it's like you had never actually closed the browser.</p>
 </dd>
 <dt>Max-Age=&lt;non-zero-digit&gt; {{optional_inline}}</dt>
 <dd>Number of seconds until the cookie expires. One or more digits 1 through 9. Older browsers (ie6, ie7, and ie8) do not support max-age. For other browsers, if both (<code>Expires</code> and <code>Max-Age</code>) are set, <code>Expires</code> will have precedence.</dd>
 <dt>Domain=&lt;domain-value&gt; {{optional_inline}}</dt>
 <dd>Specifies those hosts to which the cookie will be sent. If not specified, defaults to the host portion of the current document location (but not including subdomains). Contrary to earlier specifications, leading dots in domain names are&nbsp;ignored. If a domain is specified, subdomains are always included.</dd>
 <dt>Path=&lt;path-value&gt; {{optional_inline}}</dt>
 <dd>Indicates a URL path that must exist in the requested resource before sending the Cookie header. The %x2F ("/") character is interpreted as a directory separator and sub directories will be matched as well (e.g. path=/docs, "/docs", "/docs/Web/", or "/docs/Web/HTTP" will all be matched).</dd>
 <dt>Secure {{optional_inline}}</dt>
 <dd>A secure cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol.
 <p class="note">Confidential or sensitive information should never be stored or transmitted in HTTP Cookies as the entire mechanism is inherently insecure.</p>
 </dd>
 <dt>HttpOnly {{optional_inline}}</dt>
 <dd>HTTP-only cookies aren't accessible via JavaScript through the {{domxref("Document.cookie")}} property, the {{domxref("XMLHttpRequest")}} and {{domxref("Request")}} APIs to prevent attacks against cross-site scripting ({{Glossary("XSS")}}).</dd>
 <dt>SameSite=Strict<br />
 SameSite=Lax {{optional_inline}}&nbsp;{{experimental_inline}}</dt>
 <dd>
 <p>Allows servers to assert that a cookie ought not to be sent along with cross-site requests, which provides some protection against cross-site request forgery attacks ({{Glossary("CSRF")}}).</p>
 </dd>
</dl>

<h2 id="Examples">Examples</h2>

<h3 id="Session_cookie">Session cookie</h3>

<p>Session cookies will get removed when the client is shut down. They don't&nbsp;specify the <code>Expires</code> or <code>Max-Age</code> directives. Note that web browser have often enabled session restoring.</p>

<pre>
Set-Cookie: sessionid=38afes7a8; httponly; Path=/</pre>

<h3 id="Permanent_cookie">Permanent cookie</h3>

<p>Instead of expiring when the client is closed, permanent cookies expire at a specific date (<code>Expires</code>) or after a specific length of time (<code>Max-Age</code>).</p>

<pre>
Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly
</pre>

<h3 id="Third_party_cookie">Third party cookie</h3>

<p>A third-party cookie belongs to a domain different from the one currently shown in the address bar. These cookies are usually set by advertisements and open up the potential for tracking the user's browsing history.</p>

<pre>
Set-Cookie: qwerty=219ffwef9w0f; Domain=somecompany.co.uk; Path=/; Expires=Wed, 30 Aug 2019 00:00:00 GMT</pre>

<h3 id="Cookie_prefixes">Cookie prefixes</h3>

<p>For clients that implement the additional assurances as specified with the special naming prefix, the cookies will only be accepted if set from a secure origin (HTTPS) and if they have the required flags set. For clients that don't implement cookie prefixes, you cannot count on having these additional assurances and the cookies will always be accepted.</p>

<pre>
// Both accepted when from a secure origin (HTTPS)
Set-Cookie: __Secure-ID=123; Secure; Domain=example.com
Set-Cookie: __Host-ID=123; Secure; Path=/

// Rejected due to missing Secure directive
Set-Cookie: __Secure-id=1

// Rejected due to the missing Secure and Path=/ directives
Set-Cookie: __Host-id=1

// Rejected due to the missing Path=/ directive
Set-Cookie: __Host-id=1; Secure'; 
</pre>

<h2 id="Specifications">Specifications</h2>

<table class="standard-table">
 <tbody>
  <tr>
   <th scope="col">Specification</th>
   <th scope="col">Title</th>
  </tr>
  <tr>
   <td>{{RFC("6265", "Set-Cookie", "4.1")}}</td>
   <td>HTTP State Management Mechanism</td>
  </tr>
  <tr>
   <td>{{RFC("draft-ietf-httpbis-cookie-prefixes-00")}}</td>
   <td>Cookie Prefixes</td>
  </tr>
  <tr>
   <td>{{RFC("draft-ietf-httpbis-cookie-same-site-00")}}</td>
   <td>Same-Site Cookies</td>
  </tr>
 </tbody>
</table>

<h2 id="Browser_compatibility">Browser compatibility</h2>

<p class="hidden">The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out <a href="https://github.com/mdn/browser-compat-data">https://github.com/mdn/browser-compat-data</a> and send us a pull request.</p>

<p>{{Compat}}</p>

<h2 id="See_also">See also</h2>

<ul>
 <li><a href="/en-US/docs/Web/HTTP/Cookies">HTTP cookies</a></li>
 <li>{{HTTPHeader("Cookie")}}</li>
 <li>{{domxref("Document.cookie")}}</li>
</ul>