FM 9-04 Chapter 9 · Web and developer
Cookie and Set-Cookie
Read Cookie and Set-Cookie headers: values, attributes, prefixes and SameSite, with security warnings.
Local only Runs in your browser. Nothing you enter leaves this page.
Header
Cookie values often contain session IDs. Nothing here is written to the address bar or sent anywhere.
__Host- cookies need Secure, Path=/ and no Domain. __Secure- cookies need Secure. Browsers cap Expires and Max-Age at 400 days (RFC 6265bis). Expires dates are read by the browser's date parser, which accepts slightly more formats than the cookie spec.