Forbidden response headers

Question

I'm confused with forbidden response headers. MDN says :

A forbidden response header name is an HTTP header name (either Set-Cookie or Set-Cookie2 ) that cannot be modified programmatically.

But i surely can send cookie response manually. So what does the word programmatically mean in this context?

Answer 1

That term comes from the Fetch specification, which concerns sending requests and accessing responses from a program in the browser. Programmatically just means doing something from a program.

So, yes, your server can set the cookie to whatever it wants, but a Javascript program that receives that response will not be able to change the value of the header.