How to use Cookie builder
- 1. Name the cookie. Session ids should be HttpOnly.
- 2. Pick SameSite. None requires Secure.
- 3. Set Max-Age. Seconds.
- 4. Copy both headers. Cookie and cache are different layers.
About this tool
Cookies are how browsers store credentials. Flags matter more than the value. Cache-Control is the sibling header people confuse with cookies — it talks to caches, not to document.cookie.
SameSite
Lax is the usual default. None is for third-party iframes and needs Secure.
HttpOnly
Keeps the cookie away from document.cookie. Still sent on requests.
Code examples
Set-Cookie
session=abc; Path=/; HttpOnly; Secure; SameSite=Lax