What each attribute does
- HttpOnly: page scripts cannot read the cookie, which limits the impact of XSS.
- Secure: the browser sends it only over HTTPS.
- SameSite: controls whether the cookie is sent on cross-site requests. Lax is a good default, Strict is tighter.
- Path and Domain: keep them narrow. Omitting Domain keeps the cookie on the exact host.
- Max-Age or Expires: shorter lifetimes reduce the window after theft.
Setting it in Next.js
import { cookies } from 'next/headers';
const jar = await cookies();
jar.set('__Host-session', token, {
httpOnly: true,
secure: true,
sameSite: 'lax',
path: '/',
maxAge: 60 * 60 * 24,
});Check what you send
curl -sI https://your-app.example/login | grep -i set-cookieFrequently asked questions
Why use the __Host- prefix?
Browsers only accept it when the cookie is Secure, has Path=/ and has no Domain attribute, so a sibling subdomain cannot overwrite it.
Should I store a JWT in localStorage instead?
An HttpOnly cookie is safer against XSS, since scripts cannot read it. Pair it with SameSite and origin checks.