Set-Cookie builder
Create a secure cookie header and the matching Spring, Servlet or Express code, with the browser rules checked.
Set-Cookie headers that browsers accept
A cookie is created by a Set-Cookie response header, and the attributes you add decide how safe and how long-lived it is. Leave off HttpOnly and an XSS bug can steal the session; leave off Secure and it travels in clear text; get SameSite wrong and either logins break or you open a CSRF hole. Browsers silently drop cookies that break the rules, which makes mistakes hard to see.
Fill in the name, value and attributes and the builder writes the header, plus the equivalent code for Spring's ResponseCookie, the Servlet Cookie API and Express's res.cookie. It enforces the rules that browsers enforce (SameSite=None needs Secure, the __Host- and __Secure- prefix requirements, legal characters in names and values) and warns when a security attribute is missing.
Good defaults for a session cookie
- Name it with the
__Host-prefix. - Set
Secure,HttpOnlyandSameSite=Lax(or Strict for sensitive apps). - Use a short
Max-Ageand rotate the session id on login. - Do not store data in the cookie; store an opaque id and keep the data on the server.
For cookies used in third-party contexts (embedded widgets, cross-site iframes), SameSite=None; Secure is required, and the Partitioned attribute (CHIPS) keeps the cookie separate for each top-level site. Servlet setAttribute("SameSite", ...) needs Servlet 6.0; older containers need a filter or a framework helper. The tool runs entirely in your browser.
Frequently asked questions
What do HttpOnly, Secure and SameSite do?
HttpOnly hides the cookie from JavaScript, limiting theft through XSS. Secure sends it only over HTTPS. SameSite controls whether it is sent on cross-site requests: Strict never, Lax for top-level navigations, None always (and then Secure is mandatory).
What is the __Host- prefix?
A cookie named __Host-... is only accepted by browsers if it has Secure, Path=/ and no Domain attribute. That locks it to the exact host and stops sub-domains from overwriting it, which makes it a good choice for session cookies.
What is the difference between Max-Age and Expires?
Max-Age is a number of seconds from now; Expires is a fixed date. If both are set Max-Age wins. Omit both to create a session cookie that is removed when the browser closes.
Why is my cookie not being set?
Common causes: SameSite=None without Secure, a __Host- prefix with a Domain or a path other than /, a value with spaces or semicolons, a Secure cookie set over plain HTTP, or a Domain that does not match the host.