Set-Cookie

Instructs a browser to store or update a cookie.

Set-Cookie is a response field with attributes such as Secure, HttpOnly, SameSite, Domain, Path, Max-Age, and Expires. Send separate fields for separate cookies.

httpheadercookiessecurity

Reference (http)

Set-Cookie: __Host-session=abc; Secure; HttpOnly; SameSite=Lax; Path=/

Set-Cookie is a response field with attributes such as Secure, HttpOnly, SameSite, Domain, Path, Max-Age, and Expires. Send separate fields for separate cookies.

Common mistakes

Joining multiple Set-Cookie fields with a comma as if they were one ordinary list field.

IANA registry: http-fields/field-names

Registry reference: RFC-ietf-httpbis-rfc6265bis-22, Section 5.8.1: Cookies: HTTP State Management Mechanism

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
MDN Using HTTP Cookies
IANA HTTP Field Name Registry