// http header · response header

Set-Cookie

Send a cookie to the client

What the Set-Cookie header does

Set-Cookie sends a cookie to the client to be stored and returned on later requests. Its attributes matter for security: HttpOnly blocks JavaScript access, Secure restricts it to HTTPS, and SameSite limits cross-site sending to reduce CSRF.

Example

Set-Cookie: sid=abc; HttpOnly; Secure

Where it's used

Set-Cookie is a response header. Response headers are sent by the server to describe the response and tell the client how to handle it.

Other response headers