'Set a response cookie.
Note:
This method can be called multiple times to add one or
more cookies to the response.
See Also:
To learn more about setting cookies, see
:ref:`Setting Cookies <setting-cookies>`. The parameters
listed below correspond to those defined in `RFC 6265`_.
Args:
name (str): Cookie name
value (str): Cookie value
Keyword Args:
expires (datetime): Specifies when the cookie should expire.
By default, cookies expire when the user agent exits.
(See also: RFC 6265, Section 4.1.2.1)
max_age (int): Defines the lifetime of the cookie in
seconds. By default, cookies expire when the user agent
exits. If both `max_age` and `expires` are set, the
latter is ignored by the user agent.
Note:
Coercion to ``int`` is attempted if provided with
``float`` or ``str``.
(See also: RFC 6265, Section 4.1.2.2)
domain (str): Restricts the cookie to a specific domain and
any subdomains of that domain. By default, the user
agent will return the cookie only to the origin server.
When overriding this default behavior, the specified
domain must include the origin server. Otherwise, the
user agent will reject the cookie.
(See also: RFC 6265, Section 4.1.2.3)
path (str): Scopes the cookie to the given path plus any
subdirectories under that path (the "/" character is
interpreted as a directory separator). If the cookie
does not specify a path, the user agent defaults to the
path component of the requested URI.
Warning:
User agent interfaces do not always isolate
cookies by path, and so this should not be
considered an effective security measure.
(See also: RFC 6265, Section 4.1.2.4)
secure (bool): Direct the client to only return the cookie
in subsequent requests if they are made over HTTPS
(default: ``True``). This prevents attackers from
reading sensitive cookie data.
Note:
The default value for this argument is normally
``True``, but can be modified by setting
:py:attr:`~.ResponseOptions.secure_cookies_by_default`
via :any:`API.resp_options`.
Warning:
For the `secure` cookie attribute to be effective,
your application will need to enforce HTTPS.
(See also: RFC 6265, Section 4.1.2.5)
http_only (bool): Direct the client to only transfer the
cookie with unscripted HTTP requests
(default: ``True``). This is intended to mitigate some
forms of cross-site scripting.
(See also: RFC 6265, Section 4.1.2.6)
Raises:
KeyError: `name` is not a valid cookie name.
ValueError: `value` is not a valid cookie value.
.. _RFC 6265:
http://tools.ietf.org/html/rfc6265'

def set_cookie(self, name, value, expires=None, max_age=None, domain=None, path=None, secure=None, http_only=True):

    if (not is_ascii_encodable(name)):
        raise KeyError('"name"    is    not    ascii    encodable')
    if (not is_ascii_encodable(value)):
        raise ValueError('"value"    is    not    ascii    encodable')
    if PY2:
        name = str(name)
        value = str(value)
    if (self._cookies is None):
        self._cookies = SimpleCookie()
    try:
        self._cookies[name] = value
    except CookieError as e:
        raise KeyError(str(e))
    if expires:
        fmt = '%a,    %d    %b    %Y    %H:%M:%S    GMT'
        if (expires.tzinfo is None):
            self._cookies[name]['expires'] = expires.strftime(fmt)
        else:
            gmt_expires = expires.astimezone(GMT_TIMEZONE)
            self._cookies[name]['expires'] = gmt_expires.strftime(fmt)
    if max_age:
        self._cookies[name]['max-age'] = int(max_age)
    if domain:
        self._cookies[name]['domain'] = domain
    if path:
        self._cookies[name]['path'] = path
    if (secure is None):
        is_secure = self.options.secure_cookies_by_default
    else:
        is_secure = secure
    if is_secure:
        self._cookies[name]['secure'] = True
    if http_only:
        self._cookies[name]['httponly'] = http_only
