A response that sets a scoped, expiring, HTTPS-only cookie

Answer

HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: session=8f3ab1; Path=/app; Max-Age=3600; secure; HttpOnly

Name and value come first; the attributes follow, semicolon-separated, in any order. `Path=/app` keeps the cookie out of the rest of the site, `Max-Age=3600` retires it after an hour, and `secure; HttpOnly` bars it from plain HTTP and from JavaScript.

Harold 4e ch6 §Keep-Alive; §Cookies; RFC 7230 §4.1 Chunked Transfer Coding