Header Prism

HTTP header & security policy tools

08Set-Cookie · RFC 6265bisBuilder & parser

Set-Cookie builder

Compose a cookie attribute by attribute, or paste the Set-Cookie lines your server sends, and see whether a browser would store it, where it would be sent and for how long.

A

Cookie

Lifetime

Where it is set

Scheme
B

Header

Accepted
Set-Cookie: __Host-session=a3f9c2e1b7; Max-Age=86400; Path=/; Secure; HttpOnly; SameSite=Lax

						

					

					

						
Browser checks

						
  • OK__Host- prefix rules are met: Secure, Path=/ and no Domain, so the cookie is locked to this exact host.
  • NoteExpires in 24 hours.

					

				

			

		


		

			
C
Parse Set-Cookie headers
one per line

			

				
				
				

				

			

		

	


	

		

			
The attributes that decide a cookie's fate

			
A browser stores a cookie only if every rule passes; otherwise it drops the whole Set-Cookie line without an error on the page. The checks above follow the cookie standard (RFC 6265 and its current revision) as browsers implement it.

			
    
				
  • Prefixes: a name starting with __Secure- must have Secure; __Host- also needs Path=/ and no Domain, which locks the cookie to one host so a subdomain cannot overwrite it.
    • 
				
  • SameSite: Lax is sent on top-level navigations from other sites, Strict never cross-site, and None everywhere, but only together with Secure.
    • 
				
  • Lifetime: Max-Age wins over Expires; zero or a past date deletes the cookie; Chromium browsers and the updated standard cap lifetimes at 400 days.
    • 
				
  • Domain: setting it widens the cookie to every subdomain. Leaving it out is the narrower, safer choice.
    • 
			

			
To delete a cookie, send the same name, Domain and Path with Max-Age=0. Check how your whole response treats cookies, including caching, with the header analyzer.

		

	


	

		
FAQ
Set-Cookie questions

		

			

				Why is my cookie not being set?
				
The usual causes are SameSite=None or a __Secure- / __Host- prefix without Secure, a Domain that does not match the host, or a Secure cookie sent from an http:// page. Paste the header above to see which rule fails.

			

			

				Should session cookies be HttpOnly?
				
Yes. HttpOnly keeps the cookie out of document.cookie, so an injected script cannot read and send it elsewhere. It still travels with requests as normal.

			

			

				What is a partitioned cookie?
				
With Partitioned, a cookie set inside an embedded frame is stored separately for each top-level site, so it works in the embed without becoming a cross-site tracker.