HTTP · Cookies, CORS and security headers
Set a secure session cookie
HttpOnly hides it from JavaScript, Secure restricts it to HTTPS, and SameSite limits cross-site sending.
Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=3600
More cookies, cors and security headers commands
- Allow a cross-origin site (CORS)
- Answer a CORS preflight
- Strict-Transport-Security: force HTTPS
- Content-Security-Policy: limit what loads
- X-Content-Type-Options: stop type guessing
- Block clickjacking
All cookies, cors and security headers commands · HTTP cheatsheet