HTTP Cookie Parser

Set-Cookie is an HTTP response header that instructs the browser to store a cookie. Its format is: 'Set-Cookie: name=value; attribute1; attribute2=value'. The server sends it in response headers, and the browser automatically sends the cookie back in subsequent requests via the Cookie request header.

The HttpOnly flag prevents JavaScript from accessing the cookie via document.cookie. This protects against XSS attacks — even if an attacker injects malicious JS, they cannot steal HttpOnly session cookies. Always set HttpOnly on session tokens, auth cookies, and CSRF tokens.

SameSite controls when cookies are sent with cross-site requests. Strict: cookie only sent for same-site requests (most restrictive). Lax: sent on top-level navigation (clicking links), but not on embedded resources. None: sent on all requests including cross-site — requires Secure flag. Modern browsers default to Lax if SameSite is omitted.

Expires sets an absolute date/time when the cookie expires (e.g., Thu, 01 Jan 2026 00:00:00 GMT). Max-Age sets a relative duration in seconds from when the cookie was received. If both are present, Max-Age takes precedence in modern browsers. Without either, the cookie is a session cookie — deleted when the browser closes.

Partitioned (Cookies Having Independent Partitioned State) is a new attribute that scopes cookies to the top-level site they were set on. When a cookie is Partitioned, it's stored in a separate jar per top-level domain — so a cookie set by widget.example.com on site-a.com is only sent to widget.example.com when embedded on site-a.com. This enables necessary third-party cookies while preventing cross-site tracking.