Set-Cookie
Asks the browser to store a cookie.
Response header (sent by servers) auth
How it works
Session cookies should have Secure, HttpOnly and SameSite=Lax or Strict, so they are not sent over HTTP, not readable by scripts and not attached to cross-site requests.
Example
Set-Cookie: session=abc; Secure; HttpOnly; SameSite=Lax; Path=/
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: RFC 6265.