Set-Cookie
Set per response by your application, so it isn't part of the builder or the grade. Open the builder →
Most session compromises are cookie problems, not header problems. A session cookie should be Secure (HTTPS only), HttpOnly (invisible to document.cookie, so XSS can't read it), and SameSite=Lax or Strict (not attached to cross-site requests, killing most CSRF). Scope it as tightly as you can: omit Domain so it stays host-only, and set Path=/ only if the whole app needs it. The __Host- prefix is the strongest guarantee available — a browser will only store a __Host--prefixed cookie if it is Secure, has Path=/, and has **no** Domain, which means a compromised sibling subdomain cannot overwrite it. SameSite=None is the dangerous one: it requires Secure, and in a third-party context it now needs Partitioned (CHIPS) to be stored at all in Chrome. Unlike the policy headers on this site, Set-Cookie is emitted per response by your application — not once in the server config — so it is documented here but excluded from the builder, the snippets, and the grade. Build one with the Set-Cookie builder on security-builders.fyi. MDN
Example
Set-Cookie: __Host-session=<opaque-value>; Path=/; Secure; HttpOnly; SameSite=LaxAttributes
| Attribute | What it does |
|---|---|
Secure | Sent only over HTTPS. Required for SameSite=None and for the __Host-/__Secure- prefixes. |
HttpOnly | Hidden from document.cookie, so XSS cannot exfiltrate it. Set it on every cookie a script does not need. |
SameSite=Strict | Never sent on any cross-site request, including top-level navigation. Best for cookies that authorize state changes; can log users out when they arrive from an external link. |
SameSite=Lax | Sent on top-level GET navigation only. The sensible default for a session cookie, and what browsers assume when SameSite is absent. |
SameSite=None | Sent on all cross-site requests. Requires Secure, and needs Partitioned to be stored in a third-party context in Chrome. Only for deliberate cross-site use. |
Path=/ | Limits which paths receive the cookie. Path is not a security boundary on its own — same-origin scripts can read across paths. |
Domain | Omit it. With no Domain the cookie is host-only; setting Domain=example.com shares it with every subdomain, so one weak subdomain can read it. |
Max-Age / Expires | Lifetime. Omit both for a session cookie that dies with the browser session; prefer short lifetimes plus server-side revocation. |
__Host- prefix | Browser-enforced: stored only if Secure, Path=/, and no Domain. A sibling subdomain cannot overwrite it — the strongest option for session cookies. |
__Secure- prefix | Browser-enforced: stored only if Secure. Weaker than __Host- (it still allows Domain), but easy to adopt. |
Partitioned | CHIPS: gives the cookie a separate jar per top-level site. Required for third-party cookies in Chrome, and it must also be Secure. |
Scoring
Not scored. The grade covers headers you can set once in server config; this one is emitted per response by the application, so a scanner can't judge it from a single request.