HTTP Cookie Builder

Set-Cookie header attributes explained

The Set-Cookie HTTP response header stores a small piece of data in the browser. Key attributes: HttpOnly prevents JavaScript from reading the cookie (mitigates XSS); Secure ensures it is only sent over HTTPS; SameSite=Lax or Strict protects against CSRF; and Max-Age sets an expiry in seconds relative to the current time (preferred over Expires).

For related security headers, see the HTTP Security Header Generator or the CSP Generator.