Cookie attributes — Secure, HttpOnly, SameSite
type: TechArticle
description: Every cookie should be Secure, HttpOnly where possible, and have an explicit SameSite. Use __Host- and __Secure- prefixes for session cookies.
language: en
is part of: Web Specification Studio
author: Web Specification Studio
publisher: Web Specification Studio
license: https://creativecommons.org/licenses/by/4.0/
date modified: 2026-07-09T00:00:00.000Z
citation: draft-ietf-httpbis-rfc6265bis — Cookies: HTTP State Management Mechanism
  type: CreativeWork
  publisher: IETF
citation: MDN — Set-Cookie
  type: CreativeWork
  publisher: MDN
citation: OWASP — Session Management Cheat Sheet
  type: CreativeWork
  publisher: OWASP
citation: web.dev — SameSite cookies explained
  type: CreativeWork
  publisher: web.dev

Web Specification Studio
type: WebSite

Web Specification Studio
type: Organization

breadcrumb
type: BreadcrumbList
item list element: Home
  type: ListItem
  position: 1
  item: https://webspecification.com/
item list element: Spec
  type: ListItem
  position: 2
  item: https://webspecification.com/spec/
item list element: Security
  type: ListItem
  position: 3
  item: https://webspecification.com/spec/security/
item list element: Cookie attributes — Secure, HttpOnly, SameSite
  type: ListItem
  position: 4
  item: https://webspecification.com/spec/security/cookie-attributes/