Set-Cookie header is not supported

[GaProgMan]

Description

The set-cookie header can be used to ensure that cookies are only sent via HTTPS and that they are not available in JavaScript via document.cookie - amongst other things.

Links to Header Information

• Set-Cookie on MDN
• Tough Cookies on Scott Helme's blog
• Set-Cookie's Secure Flag on OWASP
• Set-Cookies HTTPOnly Flag on OWASP
• Cookie Security by David Johansson

[GaProgMan]

It's important to note that this header is NOT listed in the Owasp Recommended Headers (as of December 31st, 2024)