topic
Verified 2026-09-18Cookie Scope and Lifetime
Domain, Path, Expires, and Max-Age control where and how long a browser sends a cookie.
Prefer host-only cookies without Domain when possible. Use Path to narrow delivery, Max-Age or Expires for deliberate lifetime control, and delete a cookie with the same name, Domain, and Path used to set it.
httpcookiessecuritysessions
Reference (http)
Set-Cookie: session=abc; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600
Prefer host-only cookies without Domain when possible. Use Path to narrow delivery, Max-Age or Expires for deliberate lifetime control, and delete a cookie with the same name, Domain, and Path used to set it.
Common mistakes
- Assuming Path is an access-control boundary, setting overly broad Domain values, or deleting a cookie without matching its original scope.