Should my session cookie have SameSite=Strict or Lax?

Strict is safest but breaks the 'logged in but session lost on click-through from external link' case. Lax is the modern default — sends the cookie on top-level navigation (clicked links) but not on cross-site iframes or POSTs. Use Lax for sessions unless you specifically need Strict.

What does Partitioned do?

Isolates third-party cookies per top-level site — same cookie name on the same third-party domain becomes different cookies when embedded on different first-party sites. Part of Chrome's privacy roadmap. Modern browsers honour it.

Why don't HttpOnly cookies show in document.cookie?

By design — HttpOnly tells the browser to keep the cookie out of JavaScript reach, so XSS exploits can't steal it. Critical for session tokens. The cookie is still sent on requests as normal.

set-cookie · samesite · secure · httponly · chips

Every cookie attribute explained

A cheatsheet for Set-Cookie attributes — scope, lifetime, security and modern CHIPS/__Host- prefixes. Static reference, runs locally.

HTTP Cookies Reference

Total

attributes

Visible

all

Security

guard cookies

Example

Set-Cookie

click copy

catalog · attributes

example · set-cookie

example header

Set-Cookie: id=abc123; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600

Combine Secure + HttpOnly + SameSite=Lax for sensible defaults. Use __Host- prefix for the strongest origin binding.

Cross-site iframes? Use SameSite=None; Secure; Partitioned to opt into CHIPS.

Quick Start

How to read Set-Cookie attributes

Every cookie has scope, lifetime, and security attributes. Pick safely.

01
Scope it
Domain= + Path= control which requests get the cookie.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
scopeIANAregistryofflinelive
scope · queryhost · IANA
```
Path=/; (host-only)
```
loaded · IANA bundlespec · ready
02
Set a lifetime
Max-Age beats Expires — use seconds for clarity.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
lifetimeRFC 9110canonicalspec-compliantlive
ttl · options3600 · live
```
Max-Age=3600
```
options applied · livecanonical
03
Lock it down
Add Secure, HttpOnly, SameSite=Lax as defaults.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
securityvalidationlintpitfallslive
flags · looked upset · ready
```
Secure HttpOnly Lax
```
result · livevalidated
04
Modern prefix
__Host- binds the cookie to a single origin and path.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
modernclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
__Host-session
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to consult the cookie cheatsheet

Auth design, security review, debugging.

Auth design

Pick the right SameSite / Secure / HttpOnly combo. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

CSRF mitigation

Compare Lax vs Strict for your form posts. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Cross-site iframes

Opt into CHIPS with Partitioned to keep cookies working. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

SDK guidance

Document expected cookie attributes for downstream apps. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Onboarding

Help new engineers learn cookie semantics quickly. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Browser support

Verify what each browser still supports / has deprecated. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Default SameSite?

All evergreen browsers default to Lax. None requires Secure.

When do I need __Host-?

For session cookies you never want shared across hosts or scoped paths — Strongest origin binding.

Difference between Strict and Lax?

Strict blocks all cross-site sending. Lax allows top-level GET navigation (great default for auth).

What is CHIPS / Partitioned?

An opt-in to scope third-party cookies to the top-level site, replacing implicit cross-site sharing.

Is anything sent to a server?

No — this page is a static reference.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!