HTML5下仅用HTML设置Cookie的可行性及正确语法咨询

Great question—let’s break this down clearly and practically:

Is using <meta http-equiv="set-cookie"> feasible? #

Short answer: No, not in any modern browser.

While HTML 4.01 technically defined http-equiv="set-cookie" as a way to mimic HTTP Set-Cookie headers via meta tags, all major browsers phased out support for this feature years ago. The core reason is security: allowing meta tags to set cookies opened up risks like cross-site cookie injection, which browsers wanted to eliminate entirely.

That’s exactly why your test code didn’t work—even though the syntax aligns with HTML 4.01 specifications, modern browsers simply ignore this meta tag completely.

What’s the status in HTML5? #

HTML5 explicitly deprecated and removed the set-cookie value for the http-equiv attribute. The spec no longer recognizes this as a valid use of the <meta> tag, so there’s no "correct syntax" for it in HTML5—it’s just not supported at all.

The correct, supported ways to set cookies #

If you need to set a cookie, use one of these standard methods:

1. Backend via HTTP Set-Cookie response header #

This is the most secure and recommended approach, especially if you need attributes like secure or HttpOnly (which blocks JavaScript access to the cookie, mitigating XSS risks). For example, in Node.js/Express:

res.setHeader('Set-Cookie', 'HolidayGlaze=Good%20yummies; expires=Sat, 25-Nov-2023 12:00:00 GMT; domain=.example.com; path=/; secure; HttpOnly');

2. Frontend via JavaScript’s document.cookie API #

You can set cookies directly in the browser using JavaScript, but note that you cannot set the HttpOnly attribute here (since that’s designed to prevent JS access). Example:

document.cookie = 'HolidayGlaze=Good%20yummies; expires=Sat, 25-Nov-2023 12:00:00 GMT; domain=.example.com; path=/; secure';

Summary #

Forget about using <meta> tags to set cookies—they’re a relic of older HTML specs that no longer function in modern browsers. Stick to HTTP response headers (for full control and security) or JavaScript’s document.cookie (for frontend-only use cases that don’t require HttpOnly).

内容的提问来源于stack exchange，提问作者Alberto Favaro